Setting up a domain
Two steps: activate email for the domain, then get ten DNS records in place. The second step is where almost all the difficulty is, and how much of it falls to you depends entirely on where the domain's DNS is hosted.
Activate the domain
Open Email → Domain Settings, pick the domain, and press Activate.
A payment method has to be on file first; without one the activation is refused. A domain already covered by a web hosting package needs no activation at all and shows Included in hosting.
For a domain you keep at another registrar, Add External Domain on the Mailboxes tab puts email hosting for it into your cart.
Activation registers the domain on the mail server and generates two DKIM keys for it, one Ed25519 and one RSA. Both are published, and outgoing mail is signed with both.
The DNS records
Every one of these has to exist before mail works. MX decides whether mail arrives at all; SPF, DKIM and DMARC decide whether the mail you send is accepted by anyone else. All ten use a TTL of 3600.
| Type | Name | Value |
|---|---|---|
MX | @ | 10 mail.itsh.dev. |
TXT | @ | v=spf1 ip4:116.203.15.70 -all |
TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc-rua@itsh.dev |
TXT | mail._domainkey | the Ed25519 DKIM key for your domain |
TXT | rsa._domainkey | the RSA DKIM key for your domain |
CNAME | autoconfig | api.itsh.dev. |
CNAME | autodiscover | api.itsh.dev. |
SRV | _autodiscover._tcp | 0 0 443 autodiscover.itsh.dev. |
SRV | _imaps._tcp | 0 1 993 mail.itsh.dev. |
SRV | _submission._tcp | 0 1 587 mail.itsh.dev. |
The two DKIM values are unique to your domain and are not listed here. Copy them from Email → DNS & Setup, which shows the full table with your keys filled in.
The last five are what makes a mail client configure itself from nothing but an address and a password. Mail still flows without them; setting up a client just becomes manual.
Who writes them
If the domain's DNS is hosted here, we do. Press Auto-configure on the DNS & Setup tab and the missing records are written into your zone. A nightly job then keeps them there, so a record deleted by accident comes back on its own.
If the domain's DNS is anywhere else, you do. Copy the table into your DNS provider by hand. Nothing on our side can reach that zone, so nothing on our side can repair it either.
Auto-configure only works on domains whose DNS is hosted here
Pressing it for a domain on external nameservers fails without telling you why: you get a bare error and no records. That is not a transient failure and retrying will not help. Add the records at your provider instead.
The button may be missing even when your DNS is here
For a domain you bought only for email, the Auto-configure button is not shown at all, even though the zone is hosted here and the records could be written. Use the table above and add them by hand.
What the nightly job does to records you already had
It repairs rather than replaces, which matters if the domain already sends mail through something else:
- An existing SPF record is extended. Our IP is merged into it instead of overwriting it, so a newsletter tool or shop already listed there keeps working.
- An existing DMARC record keeps its policy but loses its
rua. The reporting address is rewritten to ours. If you collect DMARC reports somewhere of your own, they stop arriving. - The apex is skipped when mail lives only on a subdomain. A domain whose mailboxes are all on
support.example.comkeeps whatever MX the apex already has, so the root domain can stay with another provider.
Checking it worked
The DNS & Setup tab marks each record Valid or Missing, resolved live rather than assumed. The domain as a whole reads configured only when all ten are present.
A record you have just added can read Missing for as long as its old TTL takes to expire elsewhere. Give it an hour before treating it as a problem.
Email on a subdomain
Email → Subdomains → Add Subdomain switches on mail for a name under the domain, so that support.example.com can have its own mailboxes and its own catch-all.
A subdomain gets the same ten records, each prefixed with its label, and its own DKIM key rather than a copy of the parent's.
Names are lowercase letters, digits and hyphens. These are reserved and refused:
www ftp mail smtp imap pop pop3 ns1 ns2 ns3 ns4 ns mx webmail autoconfig autodiscoverA subdomain cannot be removed while it still has mailboxes on it.
What's next
- Connecting a mail client once the first mailbox exists
- Mailboxes and aliases to create addresses