- The three-record route needs a DNS host that accepts NS records
- The recommended route publishes an NS record set at mail.yourdomain.com and one CNAME at _dmarc.yourdomain.com, at the host you already use. Nearly every host allows this. A few registrar panels do not accept an NS record on a subdomain; on those the scan says so and offers the other routes instead of failing later.
- An existing DMARC record must not use strict alignment
- If your domain already publishes a DMARC record with adkim=s or aspf=s, mail signed and sent through mail.yourdomain.com fails its alignment check, and the three-record route cannot pass. The scan detects it before you choose. Relax the record to the default relaxed alignment, or move the whole domain instead.
- Receiving at [email protected] needs one MX record you publish
- The three records make the domain send. To receive at the bare domain you publish one MX record we show during setup. It is optional, and it comes with a warning if the domain already receives mail somewhere else, because changing an MX moves that mail.
- Moving the whole domain replaces your nameservers
- The full route points the domain's nameservers at us, and from then on we run every record. Before the switch we scan the domain, take a backup and carry the records over. A record the scan cannot see, because it was never published, has to come from you. It is the only route that changes where your website's records are served from, and it settles in hours rather than minutes.
- Subdomain-only zones are not offered
- We used to offer a protected em.yourdomain.com corner with addresses on the subdomain. Hosting a subdomain as its own zone is sold by the DNS provider it depended on only on an enterprise plan, so the option failed for everyone who tried it, and it has been removed. The three-record route replaces it with addresses on the bare domain and the same protection for your website.