SPF, DKIM & DMARC for Fastmail.
Fastmail authenticates your custom domain with plain DNS records rather than a one-click wizard: a single shared SPF include, three DKIM CNAMEs that Fastmail rotates for you, MX records for receiving, and a DMARC policy you add yourself. There are two ways to publish them — let Fastmail host your domain's DNS and it configures everything automatically, or keep DNS at your registrar and add the records by hand, then click "Recheck DNS" so Fastmail verifies them and starts signing your mail. Either way the goal is the same: mail you send through Fastmail is authenticated as your own domain, with SPF and DKIM both aligned, so it clears modern inbox requirements instead of getting filtered.
Why authenticate Fastmail?
Authenticating a Fastmail custom domain isn't optional housekeeping — it decides whether your mail reaches the inbox. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail in 2025. Even below those thresholds, an unauthenticated domain is the fastest route to the spam folder. Fastmail has a specific wrinkle that makes DKIM setup matter: it signs your outgoing mail with two signatures — one for the domain in your From header and one for its own messagingengine.com domain — but it only signs with your domain once it has verified your three DKIM CNAMEs. Until then your mail carries only the d=messagingengine.com signature, which does not align to your From address and can't carry DMARC on its own. Publishing SPF, the DKIM CNAMEs, and DMARC closes that gap: SPF aligns via your own envelope domain, DKIM aligns via the fm selectors on your domain, DMARC passes, and the sending reputation you build accrues to your domain instead of Fastmail's shared infrastructure.
The SPF reality for Fastmail
Fastmail is a genuine "include" provider: you add one shared mechanism, include:spf.messagingengine.com, to the single SPF TXT record on your domain — the full record is v=spf1 include:spf.messagingengine.com ~all. This is a real shared include (every Fastmail domain uses the same one), not CNAME delegation. It resolves to a flat record — currently v=spf1 ip4:103.168.172.128/27 ip4:202.12.124.128/27 -all — with no nested includes, so it costs exactly ONE of your 10 allowed SPF DNS lookups (RFC 7208), not the two or three some older guides imply. Because Fastmail uses your own domain as the envelope/Return-Path when you send, SPF actually ALIGNS to your organizational domain and contributes to a DMARC pass on its own — something Return-Path-owning bulk ESPs can't do. One Fastmail-specific quirk: Fastmail's own setup instructions publish the record ending in ?all (neutral), not ~all (softfail). The all qualifier only affects sources that AREN'T Fastmail — mail from Fastmail's IPs passes SPF either way — but ?all tells receivers to treat unlisted/spoofed sources as neither pass nor fail, which is weaker anti-spoofing than ~all. Fastmail historically chose neutral so it wouldn't be blamed for mail from your other senders; if Fastmail is your only sender (or you've listed all of them), ~all is the more DMARC-friendly choice. Keep exactly one SPF record on the domain: if you also send through Google Workspace, SendGrid, Mailchimp, etc., merge every mechanism into one v=spf1 line rather than publishing a second SPF TXT (two SPF records is a PermError).
Two ways to set it up
Let Fastmail host your DNS (automatic)
- Point your domain's nameservers to Fastmail and it publishes MX, SPF, the three DKIM CNAMEs, and a starter DMARC for you
- DKIM keys rotate automatically and stay verified — nothing to re-edit
- Best when Fastmail is your main mail host and you don't run other DNS records (web, other tools) that you'd rather keep at your registrar
- Fewer chances to fat-finger a record or trigger host-field doubling
Keep external DNS (add records by hand)
- Leave DNS at your registrar/Cloudflare and add the MX, SPF, DKIM CNAMEs, and DMARC yourself
- Necessary if your website, other subdomains, or other senders already live at that DNS host
- After publishing, go to Settings → Domains and click Recheck DNS so Fastmail verifies and starts DKIM-signing with your domain
- You own the SPF line, so you merge Fastmail's include with any other senders and manage the 10-lookup budget
Step by step
- 1
Add your domain
Sign in and go to Settings → Domains, then add your domain (you'll also have done this during signup if you started with a custom domain). Fastmail shows the exact records your domain needs and whether each one is currently detected.
- 2
Choose who hosts your DNS
Decide between letting Fastmail host your DNS (repoint your registrar's nameservers to Fastmail and it auto-configures MX, SPF, DKIM, and a starter DMARC) or keeping DNS where it is and adding the records manually. For most people with an existing website or other DNS records, keep external DNS and follow the manual steps below.
- 3
Add the MX records (receiving)
So Fastmail can receive mail for your domain, add two MX records on the root: host @ (or blank) → in1-smtp.messagingengine.com with priority 10, and a second → in2-smtp.messagingengine.com with priority 20. Remove any old MX records pointing at a previous mail host.
- 4
Publish the SPF record
Add a TXT record on the root domain (host @ or blank) with v=spf1 include:spf.messagingengine.com ~all. If an SPF record already exists, don't create a second one — merge include:spf.messagingengine.com into the existing v=spf1 line. (Fastmail's own instructions show ?all; ~all is the stronger, DMARC-friendlier qualifier once all your senders are listed.)
- 5
Add the three DKIM CNAME records
Create three CNAME records: host fm1._domainkey → fm1.yourdomain.com.dkim.fmhosted.com, host fm2._domainkey → fm2.yourdomain.com.dkim.fmhosted.com, host fm3._domainkey → fm3.yourdomain.com.dkim.fmhosted.com. These must be CNAME (not TXT or A) — there's no key to paste. If your panel is behind Cloudflare, set them to DNS-only (grey cloud).
- 6
Publish the DMARC record
Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only — it changes nothing about delivery while you confirm Fastmail mail passes aligned SPF and DKIM. On external DNS, Fastmail doesn't create this record for you (Fastmail-hosted DNS adds a starter p=none automatically).
- 7
Click Recheck DNS
Back in Settings → Domains, open your domain and click Recheck DNS. Fastmail re-scans and, once it sees the three DKIM CNAMEs resolve, flips DKIM signing on for your domain. Until this verifies, Fastmail signs your mail only with d=messagingengine.com (which doesn't align to your From address).
- 8
Send a test and read the headers
Send a message from your Fastmail address to a Gmail account, open it, and choose ⋮ → Show original. Confirm SPF: PASS, DKIM: PASS with signed-by: yourdomain.com (selector fm1, fm2, or fm3 — not messagingengine.com), and DMARC: PASS, all aligned to your domain.
- 9
Repeat for subdomains and extra domains
The root records don't cover subdomains. If you send from an address on a subdomain (e.g. news@mail.yourdomain.com) or from a second domain, add MX, SPF, and its own three DKIM CNAMEs on that name too, then Recheck DNS again.
Records to add
Fastmail generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| MX | @ | 10 in1-smtp.messagingengine.comPrimary MX (receiving). Priority 10. |
| MX | @ | 20 in2-smtp.messagingengine.comSecondary MX (receiving). Priority 20. |
| TXT | @ | v=spf1 include:spf.messagingengine.com ~allRoot SPF — keep just one SPF record; merge other senders into this line. Fastmail's wizard uses ?all; ~all is stronger. Costs 1 DNS lookup. |
| CNAME | fm1._domainkey | fm1.yourdomain.com.dkim.fmhosted.comDKIM selector 1 (auto-rotated by Fastmail). CNAME, not TXT — replace yourdomain.com with your real domain. |
| CNAME | fm2._domainkey | fm2.yourdomain.com.dkim.fmhosted.comDKIM selector 2 (auto-rotated). |
| CNAME | fm3._domainkey | fm3.yourdomain.com.dkim.fmhosted.comDKIM selector 3 (auto-rotated). |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYour DMARC policy — one per domain. Start at p=none, then tighten to quarantine/reject. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Fastmail's setup costs against that budget.
Fastmail adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
Fastmail DKIM is delegated through three CNAME records, not a TXT key you copy. You add fm1._domainkey, fm2._domainkey, and fm3._domainkey on your domain, each pointing to fmN.yourdomain.com.dkim.fmhosted.com. Fastmail holds the private keys behind those three selectors and rotates the published keys on its own to keep up with best practice — that's the whole reason there are three CNAMEs rather than one static TXT record, and it means you never have to touch DKIM in DNS again. Crucially, Fastmail does not start signing your outgoing mail with your domain until it has verified that all three CNAMEs resolve. Before that, it signs only with d=messagingengine.com, a signature that does not align to your From domain and therefore can't carry DMARC. After you publish the CNAMEs, go to Settings → Domains, open your domain, and click Recheck DNS to force verification; once it shows the domain as set up, mail is signed with d=yourdomain.com using selector fm1 (cycling through fm2/fm3 as keys rotate). Add each record as CNAME (not TXT or A) — many DNS panels default a new record to A or TXT, which silently breaks DKIM. If you let Fastmail host your DNS, these three records are created and maintained for you automatically.
DMARC
DMARC is a separate policy record you publish yourself — on external DNS, Fastmail doesn't create it for you (if you let Fastmail host your DNS, it adds a starter p=none record automatically). Add a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but tells receivers to email you aggregate reports so you can confirm that Fastmail mail is passing SPF and DKIM aligned to your domain. Because Fastmail aligns both mechanisms — SPF via your own envelope domain and DKIM via the fm selector on your domain — you should see clean, aligned passes as soon as the three DKIM CNAMEs verify. Watch the rua reports for a week or two, make sure every legitimate sender (Fastmail plus any other tools you use) is authenticating, then tighten the policy to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole domain no matter how many senders you use — never add a second DMARC record for Fastmail specifically. Note that if Fastmail hosts your DNS, moving past p=none means disabling its auto-generated record and publishing your own at the stronger policy. DMARC at enforcement is also what makes the SPF ?all-vs-~all question moot for spoofers: even a neutral SPF result on an unauthorized source is caught by a p=reject policy.
Check it actually worked
Don't trust the Settings → Domains status alone — confirm it on a real message. Send yourself a test from your Fastmail address to a different mailbox (Gmail is easiest), open it, and choose ⋮ → Show original. You want SPF: PASS (with the envelope/mailed-by domain showing yourdomain.com), DKIM: PASS with signed-by: yourdomain.com and selector fm1/fm2/fm3 — not messagingengine.com — and DMARC: PASS. If DKIM shows only messagingengine.com, your CNAMEs haven't verified yet: recheck that dig CNAME fm1._domainkey.yourdomain.com resolves to fm1.yourdomain.com.dkim.fmhosted.com, then click Recheck DNS in Fastmail. You can also spot-check the raw records with dig TXT yourdomain.com (SPF), dig CNAME fm1._domainkey.yourdomain.com (DKIM), and dig TXT _dmarc.yourdomain.com (DMARC). Finally, run the domain through Qualisend's domain health check to confirm every record resolves and your SPF stays under the 10-lookup limit, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Fastmail should appear as an aligned, fully-passing source.
Common gotchas
- DNS setup
DKIM is CNAME, not TXT — there's no key to paste. Many DNS panels default a new record to A or TXT, which silently breaks DKIM. Each fmN._domainkey must be a CNAME pointing at fmN.yourdomain.com.dkim.fmhosted.com.
- DNS setup
Fastmail won't DKIM-sign with your domain until it verifies all three CNAMEs. Until then it signs only with d=messagingengine.com, which doesn't align to your From address and can't carry DMARC. Publish the CNAMEs, then click Recheck DNS in Settings → Domains.
- Coverage
Fastmail's setup shows the SPF record ending in ?all (neutral). Fastmail mail still gets an SPF pass either way, but ?all treats spoofed/unlisted sources as neither pass nor fail — switch to ~all once all your senders are listed for stronger anti-spoofing.
- DNS setup
Host-field doubling: registrars often auto-append your domain, turning fm1._domainkey into fm1._domainkey.yourdomain.com.yourdomain.com. Enter just the label (fm1._domainkey) if the panel adds the domain for you.
- Breaks auth
Keep exactly one SPF TXT record on the root. If a record already exists, merge include:spf.messagingengine.com into it — publishing a second v=spf1 record is itself a PermError.
- DNS setup
Subdomains aren't covered by the root records. To send from an address like news@mail.yourdomain.com you need MX plus its own SPF and three DKIM CNAMEs on mail.yourdomain.com, then another Recheck DNS.
- Coverage
Pick one DNS owner. If you repoint your nameservers to Fastmail, it manages MX/SPF/DKIM automatically — don't also hand-add conflicting records at your old registrar, or the two will fight.
- Coverage
Don't hardcode Fastmail's sending IPs into your SPF. Use include:spf.messagingengine.com so Fastmail can change its IP ranges without breaking your auth; a flattened ip4: list goes stale and starts failing SPF.
Build your SPF record
Fastmail is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listFastmail SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.