Six lines to copy, once and for all
The DNS records to add, host by host, with each one's specific pitfall.
10 min read
This is the step that puts most people off, because it speaks a foreign language: TXT records, CNAME, propagation. In reality, it's about copying six lines into the interface that manages your domain. Mailcheer gives them to you ready-made: this guide tells you where to paste them, and what gets stuck when it does.
Start with yours
Where does your domain stand, right now
Before reading anything: enter your domain name. We check its public DNS and tell you which of the three roles — SPF, DKIM, DMARC — is already set up for you. Free, no account needed, and it tells you which sections of this page apply to you.
To see the raw records, what each one declares and what is missing: the full readout for your domain, still free and without an account.
First: where is your domain?
Not necessarily where you bought it. What matters is knowing who manages your DNS — often visible in your domain's 'name servers'.
If your name servers end with cloudflare.com, it's Cloudflare managing them, even if you bought from OVH. That's pitfall number one: spending an hour editing the right records in the wrong place.
Mailcheer reads your name servers and shows the path for your specific host on the domain screen, above the lines to copy. You don't have to guess which one it is.
If it's Cloudflare, Mailcheer adds the records for you: the Post to Cloudflare button on the domain screen, with a key you create yourself and that Mailcheer does not keep.
The six lines, and the three roles they play
Three CNAME signature records (DKIM). These are the ones that look like gibberish: you copy them as-is — that's the full instruction.
One MX and one TXT on mail.yourdomain.com, a subdomain created for the purpose. The MX points to feedback-smtp.eu-west-1.amazonses.com — Ireland, where sends go out. That's where bounces and complaints come back.
One TXT on _dmarc, in a permissive policy (p=none) to start: you observe before tightening.
If you already have an SPF record, leave it alone. Mailcheer's SPF goes on the mail. subdomain, never on your root domain: nothing needs to be merged, and your current mail setup is not affected.
Verifying, and why it fails
In Mailcheer: Domains → Add a domain, then Check now below the list of records. Propagation takes anywhere from a few minutes to a few hours — rarely the twenty-four hours announced everywhere.
The screen shows three indicators, not one: the signature, the return address, DMARC. The domain is marked Verified as soon as the three CNAME records are read — the MX may still be missing. Your emails will go out anyway, but with Amazon's return address instead of yours. Add all six.
When it's stuck, it's almost always one of three things: the records were added with a host that no longer manages your DNS, the Cloudflare proxy is still orange on a CNAME, or the subdomain was entered in full where the host expects the short form.
Your host, specifically
The exact path, host by host
You only have one host: the rest is noise. Pick yours and you'll get its exact click path, the real names of its tabs, and its specific pitfall — the one that makes verification fail when everything looks right.
Cloudflare
- Open your domain in the Cloudflare dashboard
- "DNS" tab → "Records"
- "Add record" for each line below
Heads upThe three CNAMEs must remain set to "DNS only" (gray cloud). If the cloud is orange, Cloudflare hides the value and verification will fail.
Open Cloudflare DNS settings →Once set, these records don't change. One hour once, against months of mail landing in spam.
Words from this guide