DNS Setup

After adding a domain, configure the required DNS records for email authentication. MailLand requires SPF, DKIM and DMARC records; all three must verify before you can send. The custom Return-Path (bounce) record is part of domain verification and is on by default for new domains; it does not block sending, and until it verifies MailLand uses its default Return-Path. A tracking domain is optional.

Get DNS Instructions

Retrieve the exact records for your domain:

GET https://api.mail.land/v1/domains/{id}/dns-instructions

Authenticate with Authorization: Bearer <token> or X-API-Key: <api key>.

Get DNS instructions

curl https://api.mail.land/v1/domains/k3v9x2m8q1w7z4/dns-instructions \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

DNS instructions response

{
  "domain": "yourdomain.com",
  "spfRecord": {
    "recordType": "TXT",
    "hostName": "@",
    "value": "v=spf1 include:spf.mlnd.net ~all",
    "status": "pending",
    "instructions": "Add this TXT record to your domain's root. If you have an existing SPF record, add 'include:spf.mlnd.net' to it instead of creating a new record."
  },
  "dkimRecord": {
    "recordType": "TXT",
    "hostName": "mlnd._domainkey",
    "value": "v=DKIM1; k=rsa; p=MIIBIjANBgkq...",
    "status": "pending",
    "instructions": "Add this TXT record with hostname 'mlnd._domainkey' to enable DKIM signing."
  },
  "dmarcRecord": {
    "recordType": "TXT",
    "hostName": "_dmarc",
    "value": "v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r; rua=mailto:[email protected]; sp=none",
    "status": "pending",
    "instructions": "Add this TXT record at the '_dmarc' subdomain to enable DMARC policy. The rua tag sends aggregate reports to a MailLand address. MailLand stores the reports for this domain for your plan's retention period and makes their DMARC pass rate, sending sources and dispositions available through the API (GET /v1/domains/{id}/dmarc/summary and /dmarc/sources). To also receive the reports yourself, add your own address to the rua tag."
  },
  "trackingRecord": {
    "recordType": "CNAME",
    "hostName": "track",
    "value": "track.mlnd.net",
    "status": "pending",
    "instructions": "Custom Tracking Links"
  },
  "bounceRecords": [
    {
      "recordType": "CNAME",
      "hostName": "bounce",
      "value": "bounce.mlnd.net",
      "status": "pending",
      "instructions": "Bounce Domain (Return-Path) DNS-only (not proxied): a proxied record hides the CNAME from mail servers."
    }
  ],
  "notes": [
    "DNS changes can take up to 48 hours to propagate globally.",
    "After adding records, click 'Verify Domain' to check the configuration.",
    "All three records (SPF, DKIM, DMARC) must be verified to start sending emails.",
    "Use your DNS provider's documentation for specific instructions on adding TXT records."
  ]
}

Each record includes a status field indicating whether it has been detected in DNS:

Status	Description
`pending`	Not checked yet
`valid`	Record found and correct
`invalid`	Record missing or incorrect

The tracking and bounce records show pending until verified, even after a failed check.

trackingRecord is returned only when the custom tracking domain is on, and bounceRecords only when the custom bounce domain is on.

Required Records

SPF (Sender Policy Framework)

SPF authorizes MailLand's servers to send email on behalf of your domain.

Field	Value
Type	TXT
Name	`yourdomain.com` (or `@`)
Value	`v=spf1 include:spf.mlnd.net ~all`
TTL	3600

If you already have an SPF record, add include:spf.mlnd.net before the ~all or -all mechanism. SPF allows only one TXT record per domain: multiple SPF records cause authentication failures.

Existing SPF example:

# Before
v=spf1 include:_spf.google.com ~all

# After
v=spf1 include:_spf.google.com include:spf.mlnd.net ~all

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email, allowing receivers to verify the message was not altered in transit.

Field	Value
Type	TXT
Name	`mlnd._domainkey.yourdomain.com`
Value	`v=DKIM1; k=rsa; p=MIIBIjANBgkq...` (your public key)
TTL	3600

MailLand generates a 2048-bit RSA key pair when you add a domain. The default selector is mlnd. The full public key value is provided in the DNS instructions response.

DKIM public keys are long (approximately 400 characters). Some DNS providers split TXT records into 255-character chunks. Most providers handle this automatically: if yours doesn't, wrap the value in double quotes and the provider should concatenate it.

DMARC (required)

DMARC tells receiving mail servers what to do when SPF or DKIM checks fail. DMARC is required: verification fails without a _dmarc record that starts v=DMARC1 and has p=.

Field	Value
Type	TXT
Name	`_dmarc.yourdomain.com`
Value	Use the exact value from the `dns-instructions` response above (it includes a unique reporting address per domain)
TTL	3600

DMARC policy options:

Policy	Behavior
`p=none`	Monitor only: no action on failures (good for initial setup)
`p=quarantine`	Send failures to spam folder (recommended starting point)
`p=reject`	Block failures entirely (strictest, best protection)

MailLand processes the DMARC aggregate reports for your domain. Publish the value from the dns-instructions response as it is: its rua address (dmarc+<id>@rpt.mail.land) is Mail.Land's report receiver. Reports for that domain, or a subdomain of it, are stored for your plan's retention period, and their DMARC pass rate, sending sources and dispositions are available through the API: GET /v1/domains/{id}/dmarc/summary and GET /v1/domains/{id}/dmarc/sources. There is no dashboard page for them yet. To also receive reports yourself, add your own address to the same tag: rua=mailto:dmarc+<id>@rpt.mail.land,mailto:[email protected].

Optional Records

Custom Return Path (bounce domain)

The custom bounce domain is part of domain verification and is turned on by default for every new domain: MailLand sends your emails with a Return-Path (the "mailed-by" address) on your own subdomain, so SPF aligns with your domain. Add one CNAME record:

Field	Value
Type	CNAME
Name	`bounce.yourdomain.com`
Value	`bounce.mlnd.net`
TTL	3600

Mail servers follow this CNAME to MailLand's mail server and SPF record, so do not add MX or TXT records at this name.

The record must be DNS-only (not proxied). A proxied record, such as Cloudflare's orange cloud, hides the CNAME from mail servers and verification fails. Do not use an MX record pointing to bounce.mlnd.net: that host does not accept mail.

MailLand re-checks this record regularly. If it is removed or changed, the custom bounce domain is no longer verified, you receive a notification, and your emails use MailLand's default Return-Path until you verify the record again. Turning the setting off and back on also requires verifying the record again.

You can turn the custom bounce domain off in the domain settings, but only after confirming a warning: the domain then sends under MailLand's shared bounce envelope, SPF is not aligned with your domain, and the envelope's reputation is shared with other senders. Domains with it off are flagged to MailLand operators. Domains created before this became the default keep their current setting; turn it on in the domain settings to get the record. Through the API, send useCustomBounce: false together with acknowledgeSharedBounceRisk: true; without it the request is refused with BOUNCE_OPT_OUT_NOT_ACKNOWLEDGED.

Tracking CNAME

If you use a custom tracking subdomain, add a CNAME:

Field	Value
Type	CNAME
Name	`track.yourdomain.com`
Value	`track.mlnd.net`
TTL	3600

The record must be DNS-only (not proxied). A proxied record, such as Cloudflare's orange cloud, answers with another certificate, so tracked links and the unsubscribe link stop working. After the CNAME verifies, MailLand requests the certificate and checks HTTPS on the host. Links keep using MailLand's default tracking host until that check passes. If it keeps failing you are notified. The CNAME is re-checked hourly.

Inbound MX

If you use inbound email processing:

Field	Value
Type	MX
Name	`@` (root) by default, or your `inboundSubdomain` (for example `in`) if you set one in domain settings. A subdomain keeps your existing mailbox provider on the root; mail to both the subdomain and the root is accepted.
Value	`mx.mlnd.net`
Priority	10
TTL	3600

An MX at the root replaces your existing mailbox provider.

DNS Provider Guides

Log in to the Cloudflare dashboard
Select your domain
Go to DNS → Records
Click Add Record for each record
For TXT records, set the proxy status to DNS only (grey cloud)
For CNAME records, set proxy status to DNS only: proxied CNAMEs can interfere with email authentication

Check DNS Records

/dns-records returns the records and their last stored status. It never queries DNS. To check DNS now, call POST /v1/domains/{id}/verify.

GET https://api.mail.land/v1/domains/{id}/dns-records

Check DNS records

curl https://api.mail.land/v1/domains/k3v9x2m8q1w7z4/dns-records \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

DNS records response

{
  "domain": "yourdomain.com",
  "spfRecord": {
    "recordType": "TXT",
    "hostName": "@",
    "value": "v=spf1 include:spf.mlnd.net ~all",
    "status": "valid",
    "instructions": "Add this TXT record to your domain's root. If you have an existing SPF record, add 'include:spf.mlnd.net' to it instead of creating a new record."
  },
  "dkimRecord": {
    "recordType": "TXT",
    "hostName": "mlnd._domainkey",
    "value": "v=DKIM1; k=rsa; p=MIIBIjANBgkq...",
    "status": "valid",
    "instructions": "Add this TXT record with hostname 'mlnd._domainkey' to enable DKIM signing."
  },
  "dmarcRecord": {
    "recordType": "TXT",
    "hostName": "_dmarc",
    "value": "v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r; rua=mailto:[email protected]; sp=none",
    "status": "valid",
    "instructions": "Add this TXT record at the '_dmarc' subdomain to enable DMARC policy. The rua tag sends aggregate reports to a MailLand address. MailLand stores the reports for this domain for your plan's retention period and makes their DMARC pass rate, sending sources and dispositions available through the API (GET /v1/domains/{id}/dmarc/summary and /dmarc/sources). To also receive the reports yourself, add your own address to the rua tag."
  },
  "trackingRecord": {
    "recordType": "CNAME",
    "hostName": "track",
    "value": "track.mlnd.net",
    "status": "valid",
    "instructions": "Custom Tracking Links"
  },
  "bounceRecords": [
    {
      "recordType": "CNAME",
      "hostName": "bounce",
      "value": "bounce.mlnd.net",
      "status": "valid",
      "instructions": "Bounce Domain (Return-Path) DNS-only (not proxied): a proxied record hides the CNAME from mail servers."
    }
  ],
  "notes": [
    "DNS changes can take up to 48 hours to propagate globally.",
    "After adding records, click 'Verify Domain' to check the configuration.",
    "All three records (SPF, DKIM, DMARC) must be verified to start sending emails.",
    "Use your DNS provider's documentation for specific instructions on adding TXT records."
  ]
}

DNS propagation can take anywhere from a few minutes to 48 hours, depending on your DNS provider and the TTL of existing records. Most providers propagate within 5–15 minutes.

Next Steps

Verification: verify domain ownership after configuring DNS
DKIM Key Rotation: manage and rotate DKIM keys
API Keys: scope credentials to specific domains

DNS Setup

Get DNS InstructionsCopy Anchor Link

Required RecordsCopy Anchor Link

SPF (Sender Policy Framework)Copy Anchor Link

DKIM (DomainKeys Identified Mail)Copy Anchor Link

DMARC (required)Copy Anchor Link

Optional RecordsCopy Anchor Link

Custom Return Path (bounce domain)Copy Anchor Link

Tracking CNAMECopy Anchor Link

Inbound MXCopy Anchor Link

DNS Provider GuidesCopy Anchor Link

Check DNS RecordsCopy Anchor Link

Next StepsCopy Anchor Link

On this page