Your domains, connected properly
Getting DNS right is where most people give up on custom-domain email. We check every record for you, set them up automatically where we can, and keep watching after you are done.
How connecting a domain works
- Add the domain. We check it, convert international names to their DNS form, and look at what is already there: who handles your DNS and where your mail goes today.
- Prove you own it with one TXT record. Until then the domain does nothing.
- Add the mail records. If your DNS is at Cloudflare, connect it with an API token and we create the records for you. Elsewhere you copy them one by one, with a step-by-step guide for your provider.
- Switch MX last. If your mail lives somewhere else today, import it first. The moment the MX records point to us, you see the first message arrive and can send a test message that reports SPF, DKIM and DMARC results.
Things we never do
- Change or remove records that are not ours, like your website or verification records
- Ask you to replace an existing SPF record: we show you how to merge ours into it
- Accept mail for a domain and then throw it away
- Tie your login to your own domain, so a DNS mistake cannot lock you out
The DNS records
Your dashboard shows the exact values for your domain with copy buttons, and marks each one green, yellow or red as we find it. Values in angle brackets are specific to your domain.
| Type | Name / host | Value / target | Priority | Status |
|---|---|---|---|---|
TXT | @ | eoinbox-verify=<your token>Proves you own the domain | Required | |
MX | @ | mx1.eoinbox.comReceiving mail | 10 | Required |
MX | @ | mx2.eoinbox.comReceiving mail (backup) | 20 | Required |
TXT | @ | v=spf1 include:spf.eoinbox.com ~allSPF, allows us to send for you | Required | |
CNAME | eo1._domainkey | eo1._domainkey.<id>.dkim.eoinbox.comDKIM signing key 1 | Required | |
CNAME | eo2._domainkey | eo2._domainkey.<id>.dkim.eoinbox.comDKIM signing key 2 | Required | |
CNAME | eo3._domainkey | eo3._domainkey.<id>.dkim.eoinbox.comDKIM signing key 3 | Required | |
TXT | _dmarc | v=DMARC1; p=none; rua=mailto:<id>@dmarc.eoinbox.comDMARC policy and reports | Recommended | |
CNAME | mta-sts | mta-sts.eoinbox.comMTA-STS policy host | Recommended | |
TXT | _mta-sts | v=STSv1; id=<policy id>MTA-STS, enforces TLS for incoming mail | Recommended | |
TXT | _smtp._tls | v=TLSRPTv1; rua=mailto:<id>@tlsrpt.eoinbox.comTLS reporting | Recommended | |
CNAME | autoconfig | autoconfig.eoinbox.comAutomatic setup in mail apps | Optional | |
CNAME | autodiscover | autoconfig.eoinbox.comAutomatic setup in Outlook | Optional | |
SRV | _imaps._tcp | 0 1 993 mail.eoinbox.comIMAP discovery | Optional | |
SRV | _submissions._tcp | 0 1 465 mail.eoinbox.comSMTP discovery | Optional | |
SRV | _jmap._tcp | 0 1 443 mail.eoinbox.comJMAP discovery | Optional |
DKIM keys rotate without you
The three DKIM records are CNAMEs that point to keys we publish. One key is active, one is ready, one is retiring, so we can rotate keys without asking you to touch DNS again.
DMARC, step by step
We start with a monitoring-only policy, read the reports for you, and suggest a stricter policy once a few weeks of reports look clean.
Secure delivery
MTA-STS and TLS reporting tell other servers to always use encryption when sending to you. We host the policy and its certificate for you.
Domain health monitoring
A domain lives outside our control. Someone can edit DNS, a registrar can change something, or the registration can simply expire. So we keep checking:
- DNS records every hour for the first two days, then daily, and right away if delivery errors spike
- Registration expiry, with reminders 30, 7 and 1 day before it ends
- DMARC and TLS reports, summarised in plain words: who sends mail as your domain, and whether it passes
- Alerts go to an address outside the affected domain, so the warning actually reaches you
What each state means
| Pending | We are waiting for the ownership record. Mail is not accepted yet. |
|---|---|
| Verified | You own the domain. Sending starts once SPF and DKIM are in place. |
| Active | Everything checks out. Mail is received and sent normally. |
| Needs attention | A record broke (for example SPF or DKIM). Mail is still received, you get a warning in webmail and by email. If DKIM is broken, sending pauses so your mail does not end up in spam. |
| Mail goes elsewhere | Your MX records now point to another provider. We tell you, and after a while ask you to verify the domain again. |
Ownership and safety
One domain, one account
A domain can be active in one account only. If someone else proves ownership through DNS, the domain moves to them and the previous account is notified. Whoever controls DNS controls the domain.
Expired domains
If a domain pointed elsewhere or did not exist for more than 30 days, it must be verified again. A new owner of an old domain never receives mail meant for the previous one.
Removing a domain
Remove a domain and its aliases stop. Messages already in your mailbox stay. If mail still arrives, senders get a clear bounce, not silence.
Moving from another provider? Read Connecting your domain, Migrating from Gmail or Migrating from Microsoft 365.