DNS records for mail

Sending or receiving mail at Cyberfusion from your own domain? This article lists the DNS records to set on your domain, what each one does, and what breaks if you skip it.

If Cyberfusion manages your DNS, these records are added automatically — you don't need to do anything. Set them yourself only if your DNS is hosted elsewhere (for example, at your registrar or at Cloudflare).

Replace <your domain> with your actual domain (for example, example.com).

Essential records

These four records make incoming and outgoing mail work.

MX — where other servers deliver mail addressed to you

When someone sends mail to you@<your domain>, the sending mail server looks up your MX record to find out where to deliver it. mx.cyberfusion.nl. is the primary destination (priority 10 — tried first). fallback.cyberfusion.nu. is the backup (priority 20 — used only if the primary is unreachable).

If you skip MX, mail to your domain has nowhere to go and senders get a bounce.

SPF — which servers are allowed to send mail using your domain

SPF tells receiving mail servers which servers may send mail claiming to come from your domain. include:_spf.cyberfusion.nl covers Cyberfusion's outgoing mail servers. -all means: reject everything else.

If you also send mail from another service (for example, Mailgun, Postmark, or your office mail server), add its include: or IP to the same record. Otherwise that service's mail will be rejected by receivers that enforce SPF — your visitors will stop receiving order confirmations, password resets, or whatever that service sends.

You can only have one SPF record per domain. If you already have an SPF record, merge Cyberfusion's include: into it; don't add a second TXT record.

DKIM — signs outgoing mail so receivers can verify it really came from you

DKIM adds a cryptographic signature to every outgoing message. The receiver looks up this DNS record to find the matching public key, checks the signature, and if it matches, knows the message was not forged or modified in transit.

Cyberfusion manages the key — you only need this CNAME. Key rotations happen on Cyberfusion's side without you having to change anything.

Skip DKIM and many receivers — Gmail and Outlook in particular — will mark your outgoing mail as spam or reject it outright.

DMARC — what receivers should do if SPF or DKIM fails

DMARC tells receivers what to do with a message that fails both SPF and DKIM checks. p=quarantine means: put it in the spam folder. pct=100 means: apply this policy to every such message.

Without DMARC, anyone can send mail pretending to be you@<your domain> and most receivers will still deliver it to the inbox. That damages your sender reputation and exposes your customers to phishing.

Mail client auto-configuration

These records let Outlook, Thunderbird, Apple Mail, and mobile mail apps configure themselves when a user enters just their email address and password — no server names, ports, or protocols to type.

If you skip them, mail still works, but users have to enter the server settings manually: vmail.cyberfusion.nl for IMAP/POP3/SMTP, ports 993 (IMAPS), 995 (POP3S), 587 (submission).

Autoconfig (Thunderbird, Apple Mail, most mobile clients)

Autodiscover (Outlook)

SRV records for IMAP, POP3 and SMTP submission

Some mail clients look up SRV records to find which server and port to use for IMAP, POP3 or SMTP submission.

Format is <priority> <weight> <port> <target>.