This guide shows the DNS records Fastmail needs so your email is authenticated: SPF, DKIM and DMARC. Use the exact values from your Fastmail account where they differ — providers update them from time to time.
1. SPF record for Fastmail
Add Fastmail to your domain's SPF record. If you have no SPF record yet, create this TXT record on the root of your domain (host @):
v=spf1 include:spf.messagingengine.com ~all
Already have an SPF record? Do not add a second one — insert include:spf.messagingengine.com before the ~all / -all at the end of your existing record.
Use the SPF Generator to combine several services and the SPF Checker to confirm you stay under 10 DNS lookups.
2. DKIM for Fastmail
In Fastmail, follow this path and publish the record it shows:
- Fastmail → Settings → Domains → your domain → DNS settings
- Add the fm1/fm2/fm3 CNAME records.
- Give DNS a few minutes, then confirm the record with the DKIM Checker.
The DKIM selector is usually fm1, so the record lives at fm1._domainkey.yourdomain.com. Enter that selector in the DKIM Checker to verify it.
3. DMARC
After SPF and DKIM pass, add a DMARC record so receivers know your policy and send you reports. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Then follow the step-by-step DMARC rollout to reach quarantine and reject safely.
4. MX records
To receive email with Fastmail, your MX records must point to Fastmail's servers (host names containing messagingengine.com, fastmail.com). Copy the exact values from your Fastmail admin panel and check them with the MX Lookup.
Where to add the records
- Cloudflare — Cloudflare dashboard → select your domain → DNS → Records → Add record. For mail records keep the proxy (orange cloud) OFF.
- GoDaddy — GoDaddy → My Products → your domain → DNS → Manage DNS → Add New Record.
- Namecheap — Namecheap → Domain List → Manage → Advanced DNS → Add New Record. Use "@" for the root domain.
- Hostinger — Hostinger hPanel → Domains → your domain → DNS / Nameservers → Manage DNS records.
- Amazon Route 53 — AWS console → Route 53 → Hosted zones → your domain → Create record. Wrap TXT values in quotes.
Frequently asked questions
Do I need SPF, DKIM and DMARC for Fastmail?
Yes. Gmail and Yahoo require SPF and DKIM plus DMARC for bulk senders, and authenticated mail is far less likely to land in spam.
Can I have two SPF records?
No. Two SPF records make SPF fail. Combine all services into one record.
How do I check that Fastmail authentication works?
Run the Domain Checker, or send a message to Gmail and use "Show original" to see SPF, DKIM and DMARC results.
What is the DKIM selector for Fastmail?
Usually "fm1" — but use the selector shown in your Fastmail admin panel if it differs.