What the DNS records actually do

The DNS records to add panel gives you several records. You do not need to understand them to add them — copy each value exactly with Copy value — but knowing what they are makes the failures easier to fix.

DKIM — the signature

Several CNAME records. They let us sign your mail with a key that mailbox providers can check against your DNS, proving the message really came from you and was not altered.

This is the part that matters most, and it is the most common thing to get wrong: DKIM values are long, and a truncated copy fails silently.

SPF — who may send for you

Says which servers are allowed to send mail using your domain.

Do not edit your root SPF record, which the Senders page warns about directly. A domain may have only one, and adding a second breaks authentication rather than doubling it. If you already have SPF — most domains using Google Workspace or Microsoft 365 do — follow the guidance shown on the page instead of creating another.

Return path — where bounces go

An MX record on a subdomain. It gives bounces somewhere to land that belongs to your domain rather than a shared one, which makes your authentication line up consistently.

They are per-domain, not per-account

Verifying example.com does nothing for shop.example.com. Each sending domain needs its own records.

Where to add them

At whoever hosts your DNS, which is not always who sold you the domain and not always where your website lives. The page has specific guidance for Cloudflare, GoDaddy, Google Domains / Squarespace and Shopify.

If a domain was migrated recently, records added at the old provider do nothing — that is the single most common reason a domain sits at Pending forever.

Next: open Senders, click Check DNS on the domain, and compare each record we list against what your provider actually returns.