Does Titan set up SPF and DKIM automatically?

No. Titan gives you the SPF include value and generates the DKIM key inside the Control Panel, but you must publish both records at your DNS host yourself, then click Verify changes in Titan for DKIM. DMARC is entirely manual — Titan doesn't create it.

What is Titan's DKIM selector?

It's usually titan1._domainkey, but always copy the exact Host Name shown in the Email Reputation → DKIM panel, since the selector and public key are generated per account.

I already have an SPF record for another service — do I add a second one?

No. Merge Titan's mechanism into your existing record so it reads, for example, v=spf1 include:_spf.google.com include:spf.titan.email ~all. Only one v=spf1 record is allowed per domain.

Do I need DKIM if I already published SPF?

Yes. Gmail and Yahoo want authentication that survives forwarding, and DMARC needs at least one of SPF or DKIM to pass AND align. Publishing both gives you redundancy and reliable DMARC alignment — set up DKIM as well as SPF.

Can I set my SPF to -all for stronger protection?

Only after you've confirmed every legitimate sender is in the record. Titan defaults to ~all (softfail); switching to -all (hardfail) before that will cause your own mail to be rejected. Let DMARC enforcement do the hard blocking instead.

How long until the records take effect?

DNS changes usually propagate within a few hours; Titan notes it can take up to a day. Verify with a DNS lookup and by sending a test to Gmail and checking Show original for PASS on all three.

Where do I set DMARC — is there a Titan setting for it?

No. DMARC is a TXT record on the _dmarc host that you add at your DNS provider, not in Titan. Start with p=none and a rua report address, then tighten to quarantine and reject.

SPF setup guide

SPF, DKIM & DMARC for Titan.

Titan is a hosted email provider: it gives you real mailboxes (send and receive) at your own domain, and it's white-labeled and resold by many hosts and registrars (Hostinger, hosting.com, Bluehost, A2 Hosting, Crazy Domains and others), so your dashboard may be branded by whoever you bought it through. Because every message leaves Titan's servers on your domain's behalf, receivers at Gmail, Yahoo, Outlook and Apple will judge those messages against the SPF, DKIM and DMARC records published in YOUR domain's DNS. Titan makes this straightforward: it publishes one shared SPF include, generates a per-account DKIM key inside its Control Panel, and leaves DMARC for you to add. This guide walks all three end to end, with Titan's exact record shapes, the Control Panel path for DKIM, and how to verify each one.

SPF include

Your DNSAdd the CNAME / TXT records

TitanSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Titan?

Since February 2024, Gmail and Yahoo require every sender to have a valid SPF or DKIM record, and bulk senders need DMARC with domain alignment — mail that fails is spam-foldered or rejected outright. Even for a small business running a handful of Titan mailboxes, missing authentication is the single most common reason legitimate mail lands in spam or bounces. SPF tells receivers Titan's servers are allowed to send for you; DKIM cryptographically signs each message so it can't be forged or altered; DMARC ties the two together, tells receivers what to do with mail that fails, and sends you reports so you can see who is sending as your domain. Publishing all three is what turns "email from Titan" into "trusted, authenticated email from your brand."

The SPF reality for Titan

Titan publishes a genuine shared SPF include, and it IS the recommended path: add `include:spf.titan.email` to your domain's single root SPF TXT record. Behind that one include, `spf.titan.email` fans out to three nested includes (`_spf1.titan.email`, `_spf2.titan.email`, `_spf3.titan.email`) plus a block of inline `ip4:` ranges — so the single `include:spf.titan.email` mechanism actually consumes about 4 of the 10 DNS lookups SPF allows. Because Titan is your mailbox host (not a side channel like a marketing tool) and sends with your own domain as the envelope sender, this include belongs in your primary domain's SPF record, not on a subdomain — and it's what lets SPF align to your domain for DMARC. Publish exactly one SPF record per domain: if you already have SPF for another sender, merge Titan's include into that existing record rather than creating a second `v=spf1` line, which would break SPF entirely.

Step by step

Titan Control Panel (may be branded by Hostinger, Bluehost, hosting.com, etc.)

1
Confirm Titan is live on your domain
Log in to your Titan Control Panel (via your host/registrar's dashboard — often an 'Admin login' or 'Manage' button next to your email product). If your domain still shows as unverified, you'll first add Titan's MX records so Titan can receive mail. Authentication (SPF/DKIM/DMARC) is separate from MX, but Titan needs to be active before DKIM can be generated.

Your DNS host (registrar or DNS provider), DNS/Zone editor

2
Add Titan's MX records (receiving prerequisite)
In your domain's DNS zone, create two MX records on the root host (@): mx1.titan.email at priority 10 and mx2.titan.email at priority 20, TTL 1 hour. These route incoming mail to Titan and are required for the mailbox to work — they don't authenticate outbound mail, but you set them in the same DNS zone as the records below.

Your DNS host, DNS/Zone editor (TXT record, host @)

3
Publish the SPF record
Add a single TXT record on the root host (@) with the value v=spf1 include:spf.titan.email ~all, TTL 1 hour. Use record type TXT (not the deprecated SPF type). If a v=spf1 record already exists for another service, do NOT add a second one — insert include:spf.titan.email into the existing record before the ~all/-all so there is exactly one SPF record.

Titan Control Panel → Email Reputation → DKIM

4
Generate the DKIM key inside Titan
In the Titan Control Panel open Email Reputation (via the account's Manage / Admin login), find DKIM and click to add/generate the key. Titan creates a public/private key pair, keeps the private key to sign your outbound mail, and shows you a Host Name (typically titan1._domainkey) and a long TXT Value beginning v=DKIM1; k=rsa; p=… . Copy both exactly — the value is unique to your account and cannot be guessed.

Your DNS host, DNS/Zone editor (TXT record, host titan1._domainkey)

5
Publish the DKIM TXT record at your DNS host
Create a TXT record with the host Titan gave you (e.g. titan1._domainkey) and paste the full v=DKIM1; k=rsa; p=… value. Enter the host exactly as shown: most registrars want just titan1._domainkey and append your domain automatically, so avoid typing the full domain twice. If the public key is very long, paste it as-is — some panels auto-split it into 255-character chunks.

Titan Control Panel → Email Reputation → DKIM → Verify changes

6
Verify DKIM back in the Control Panel
Return to Titan's Email Reputation / DKIM screen, tick 'I've added TXT records in my DNS control panel' and click Verify changes. Titan won't start signing with the key until this reverification succeeds, even if the DNS record is already correct. Status should move to VERIFIED; allow up to your TTL (and up to a few hours) for DNS to propagate first.

Your DNS host, DNS/Zone editor (TXT record, host _dmarc)

7
Add a DMARC record (start at p=none)
Create a TXT record on host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none monitors without affecting delivery while you confirm SPF and DKIM both pass and align to your domain. The rua address collects the aggregate XML reports that show every source sending as your domain — point it at a mailbox you actually read. The default relaxed alignment already passes for Titan, so you don't need to add adkim=s/aspf=s.

Any inbox test + Qualisend / DNS lookup tools

8
Verify, then tighten DMARC enforcement
Confirm all records resolve (see Verify below) and send a test message to a Gmail account, checking 'Show original' for SPF=PASS, DKIM=PASS and DMARC=PASS. Once your reports show clean alignment for a week or two, raise DMARC to p=quarantine and eventually p=reject to actively block spoofing.

Records to add

Titan generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
MX	@	mx1.titan.emailPriority 10. Receiving only — required for the mailbox, not for outbound authentication.
MX	@	mx2.titan.emailPriority 20. Secondary mail exchanger.
TXT	@	v=spf1 include:spf.titan.email ~allOne SPF record per domain. If you send via other services too, merge their mechanisms into this single record before ~all.
TXT	titan1._domainkey	v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC… (unique key from your Control Panel)Illustrative — the selector host and public key are generated per account in Titan's Email Reputation panel. Copy the exact host and value Titan shows you.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comStart at p=none to monitor, then move to quarantine and reject. Point rua at a mailbox you actually read. One _dmarc record per domain — relaxed (default) alignment already passes for Titan.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Titan's setup costs against that budget.

SPF 10-lookup budget4 used · 6 free

Titan adds 4 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

Titan uses per-account DKIM keys that you generate inside the Control Panel — there is no CNAME delegation and nothing is signed until you both publish the key and reverify it in Titan. Open Email Reputation (reached via Manage / Admin login on your Titan account), find DKIM, and generate the key pair. Titan keeps the private key and signs outbound mail; it shows you a Host Name — typically titan1._domainkey — and a TXT value starting v=DKIM1; k=rsa; p=… . Publish that as a TXT record at your DNS host using the exact host provided, then return to Titan, confirm you added it, and click Verify changes so the status flips to VERIFIED. The key is unique to your account, so you can't copy one from another domain or from documentation. If your domain's DNS lives at Cloudflare, keep the TXT record set to DNS-only (proxying doesn't apply to TXT, but make sure you're editing the authoritative zone Titan's nameservers resolve, not a stale one).

DMARC

Titan does not create DMARC for you — you add it manually as a TXT record on the _dmarc host. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com so you monitor without risking delivery, and point rua at a mailbox you check (or a report analyzer). DMARC passes when SPF or DKIM passes AND aligns with your From domain, and Titan gives you both: its include:spf.titan.email path uses your own domain as the envelope sender (so SPF aligns), and its DKIM signature carries d=yourdomain.com (so DKIM aligns) once the key is generated and verified — you'll typically see both pass. Because Titan sends on your exact root domain, the default relaxed alignment already passes cleanly, so there's no need to force strict alignment (adkim=s/aspf=s), which only adds fragility if you later send from a subdomain or another tool. After a week or two of clean aggregate reports, raise the policy to p=quarantine, then p=reject to actively stop anyone spoofing your domain. Keep exactly one _dmarc record for the whole domain no matter how many senders you use.

Check it actually worked

Check DNS from the command line: dig TXT yourdomain.com (SPF), dig TXT titan1._domainkey.yourdomain.com (DKIM), and dig TXT _dmarc.yourdomain.com (DMARC) — Windows users can use nslookup -type=TXT. Confirm MX with dig MX yourdomain.com or mxtoolbox.com. In Titan, the Email Reputation panel should show DKIM as VERIFIED and Domain Verification as complete. The definitive test: send a message from your Titan mailbox to a Gmail account, open 'Show original', and confirm SPF: PASS, DKIM: PASS and DMARC: PASS with your domain shown. For a single consolidated report across all three records plus alignment, run your domain through Qualisend's SPF/DKIM/DMARC checker and domain health check.

Domain health check DMARC report analyzer

Common gotchas

Breaks auth
DKIM must be generated in Titan first — you cannot guess or reuse a key. The value is unique per account, and Titan won't sign your mail until you click 'Verify changes' after publishing it, even if the DNS record is already live.
Breaks auth
Never publish two SPF records. If you already have a v=spf1 line for another service, add include:spf.titan.email into that one record — a second SPF TXT record makes SPF fail with a permerror.
Breaks auth
Titan's include already spends ~4 of your 10 SPF lookups (spf.titan.email nests _spf1/_spf2/_spf3 plus inline ip4 ranges). If you also send through other tools, watch the 10-lookup limit or SPF will hit permerror.
Coverage
Don't switch ~all to -all prematurely. Titan's default is ~all (softfail); only harden to -all once you're certain every legitimate sender — Titan plus any others — is included, or you'll bounce your own mail.
DNS setup
Host-field double-appending: most registrars append your domain automatically, so enter the DKIM host as titan1._domainkey, not titan1._domainkey.yourdomain.com. A doubled domain silently breaks the record.
Coverage
Your Control Panel may be white-labeled by your host (Hostinger, Bluehost, hosting.com, A2, Crazy Domains). The menu might be branded differently, but the flow — Manage/Admin login → Email Reputation → DKIM → Verify changes — is the same.
Breaks auth
MX is not authentication. Adding mx1/mx2.titan.email lets you receive mail but does nothing for SPF/DKIM/DMARC — you still need all three records for outbound mail to pass at Gmail and Yahoo.
Coverage
Edit the authoritative zone. If your domain uses external nameservers (e.g. Cloudflare) rather than your registrar's default DNS, add the records where the nameservers actually resolve, or Titan's verification will keep failing.

Build your SPF record

Titan is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

Titaninclude:spf.titan.emailGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:spf.titan.email ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list