The DNS records your email needs (MX, SPF, DKIM, DMARC)

Applies to: All plans.

Your email needs a few DNS records to work. MX routes incoming mail to your mailboxes. SPF lists the servers allowed to send mail for your domain, DKIM adds a signature to your outgoing mail, and DMARC tells receivers what to do with mail that fails those checks; together they let receiving servers check that mail sent in your domain's name really comes from you. Autodiscover and autoconfig records let mail apps such as Outlook and Thunderbird find their settings from just your email address. The values depend on where your mailboxes are:

• Mailboxes included with your hosting plan: the records point at our mail server. If your domain uses our nameservers, we add them for you.
• Professional Email (Microsoft 365 or Google Workspace): the records point at Microsoft or Google, and the exact values come from their admin console.

If your domain uses our nameservers, you manage all of these in your client area DNS manager, not in the cPanel zone editor. If your DNS is hosted somewhere else, you add them at that provider.

Mailboxes included with your hosting plan

On our nameservers: added for you

When we create the DNS zone for your hosting, we add these records automatically. There is nothing to type in; you can see them in your client area DNS manager.

• MX mx.maxinodes.com, priority 10: brings incoming mail to your mailboxes on our server.
• A and AAAA for mail, webmail, autoconfig and autodiscover, pointing at 185.185.49.198 and 2a00:7c80:0:286:c::10: the names your mail apps and webmail use.
• SRV _autodiscover._tcp with the value 0 0 443 cpanelemaildiscovery.cpanel.net: helps Outlook find its settings.
• SPF, a TXT record on the domain itself: v=spf1 include:_spf.maxinodes.com ~all. It authorises our servers to send mail for your domain. If the zone already had an SPF record, we leave that one in place rather than add a second; see the note on merging below.
• DKIM, a TXT record at default._domainkey: the public key made for your domain. Our server starts signing your outgoing mail with it within about a day of the record being published.
• DMARC, a TXT record at _dmarc: v=DMARC1; p=none, added only if your domain has no DMARC record yet. p=none asks receivers to take no special action on mail that fails the checks; you can make it stricter later.
• _mailchannels, a TXT record: v=mc1 auth=maxinodes. It tells our outbound mail relay that only our servers may send mail for your domain through it.

Two exceptions:

• Your mail was elsewhere when we created the zone. If your domain's MX pointed at another provider at that moment (Microsoft 365, Google Workspace, or an old host whose mail server's name is outside your domain, for example mx.oldhost.com), we copied that provider's records instead, so your mail keeps arriving where it is. To move that mail into the included mailboxes, see When to point your MX at us below.
• Your zone was created some time ago. Older zones may be missing some of these records. Add the missing ones from the record sheet below, or ask us to add them.

DNS hosted elsewhere: the record sheet

If your domain's DNS stays with another provider (your registrar, Cloudflare or similar), add these records there. @ means the domain itself; some providers want the full name instead, for example mail.yourdomain.com. Use a TTL of 3600 seconds (1 hour), or your provider's default.

• SPF: one record only. If your domain already has an SPF record (a TXT record that starts with v=spf1), don't publish a second one: add include:_spf.maxinodes.com to the existing record, before its final ~all or -all. For example: v=spf1 include:_spf.google.com include:_spf.maxinodes.com ~all. Two SPF records make the SPF check fail.
• DMARC: only if you have none. If _dmarc already has a record, keep yours.
• DKIM: ask us for the value. The key is made for your domain on our server, and the cPanel page that shows it isn't available in your cPanel, so ask us and we send you the exact value. Paste it exactly as sent, as a single value. Our server starts signing your mail within about a day of the record being published.
• SRV: some DNS providers ask for the parts separately: service _autodiscover, protocol _tcp, priority 0, weight 0, port 443, target cpanelemaildiscovery.cpanel.net.
• Certificates: once the mail and webmail records point to us, the free certificate for those names is issued automatically. Until then, mail apps can use node11.maxinodes.com as the server name.

When to point your MX at us

The MX record decides where incoming mail is delivered. As soon as it points at mx.maxinodes.com, new mail for every address on the domain arrives on our server, and mail for an address that has no mailbox or forwarder here is bounced back to the sender. So:

1. Create the mailboxes first (see How to create a mailbox) and check that you can sign in to them in webmail.
2. If you have mail at another provider, copy it across. We move it for you, free on every plan: see How to move your existing email to Maxinodes.
3. Then replace the old MX records with ours. Don't keep both: your mail would be split between the old server and ours.
4. Keep the old mailboxes for about a week. While the change spreads, some mail can still arrive there, and a final copy picks it up.

Switching nameservers can move your MX at the same moment. If your old host's mail server had a name in your domain (for example mail.yourdomain.com), your zone here was created with our mail records, so incoming mail starts arriving here as soon as the nameservers switch. Tell us before you switch nameservers or cancel your old hosting: we check which case applies and move your mailboxes and mail with you, free of charge.

Professional Email (Microsoft 365 or Google Workspace)

For Microsoft 365 or Google Workspace, the MX, SPF, DKIM and autodiscover records point at Microsoft or Google instead. If you ordered your seats through us, we change the records for you. If you do it yourself:

• Replace our mail records, don't add to them. Delete our MX record (mx.maxinodes.com) and add your provider's. Also delete the records we added for mail apps (the SRV record _autodiscover._tcp and the A and AAAA records for autodiscover and autoconfig), so apps find your provider's settings, not ours. Microsoft 365's autodiscover CNAME can only be added once the other autodiscover records are gone.
• Keep one SPF record. Replace include:_spf.maxinodes.com with your provider's include, unless your website also sends mail from our server (contact forms, shop receipts, password resets). In that case keep both in the one record, for example v=spf1 include:spf.protection.outlook.com include:_spf.maxinodes.com -all, and keep the _mailchannels and default._domainkey records too (if your zone doesn't have them, ask us).
• Tell us when you switch. Our server needs to know that your domain's mail is now with Microsoft or Google, so that messages your website sends to your own addresses (from a contact form, for example) go to them instead of staying on our server.

Microsoft 365 — standard records

These are the standard templates. The exact values for your tenant come from the Microsoft 365 admin centre (in the area for setting up or verifying your domain) — always copy them from there.

Your <yourtenant> value and both DKIM CNAME targets are unique to your account — read them from the option in the admin centre that lists your DNS records.

Google Workspace — standard records

These are the standard templates. The exact values for your tenant come from the Google Workspace setup wizard / admin console — always copy them from there.

The single smtp.google.com MX record applies to modern tenants. Older tenants use five separate ASPMX.L.GOOGLE.COM MX records instead — follow whatever the setup wizard shows for your domain. Your DKIM TXT value is generated inside the admin console, so copy it from there.

Where to add the records

If your domain uses our nameservers (ns1.maxinodes.com and ns2.maxinodes.com), add and edit records in your client area DNS manager at my.maxinodes.com — not in the cPanel zone editor. For step-by-step instructions, see How to manage DNS records in your client area. If your DNS is hosted somewhere else, add the records at that provider; the record sheet above lists what the included mailboxes need.

Good to know

• DNS changes are not instant. Allow time for records to propagate before testing — usually minutes, occasionally up to a few hours.
• One SPF record only. A domain must have a single SPF TXT record. If you send from more than one service, combine the include: parts into one record rather than adding a second SPF line.
• If you ordered your seats through us, we set this up for you. Seats bought from us include guided email setup and free migration, and we configure SPF, DKIM and DMARC for you — on any hosting plan.
• Not sure which case applies to your domain? Ask us. We check the records your domain has now and tell you whether anything needs to change.

Related articles

• Email at Maxinodes: your mailboxes, or Microsoft 365 / Google Workspace
• How to create a mailbox
• Mail app settings for your mailbox (IMAP, POP3, SMTP)
• How to move your existing email to Maxinodes
• How to manage DNS records in your client area
• Your Maxinodes nameservers
• How to add a TXT record (verification, SPF, DMARC)
• How to add Professional Email to your hosting