DNS records for mail

Sending or receiving mail at Cyberfusion from your own domain?

This article lists the DNS records to set on your domain, what each one does, and what breaks if you skip it.

The records

If Cyberfusion manages your DNS, these records are added automatically and you don't need to do anything. Set them yourself only if your DNS is hosted elsewhere, for example at your registrar or at Cloudflare.

Replace <your domain> with your actual domain, for example example.com.

The auto-configuration records are optional. Without them mail still works; users just enter the server settings by hand.

MX: where other servers deliver your mail

When someone sends mail to you@<your domain>, the sending server looks up your MX record to find where to deliver it.

• mx.cyberfusion.nl. has priority 10, so it is tried first.
• fallback.cyberfusion.nu. has priority 20, used only when the primary is unreachable.

Skip it and mail to your domain has nowhere to go. Senders get a bounce.

SPF: which servers may send as your domain

include:_spf.cyberfusion.nl covers Cyberfusion's outgoing mail servers. -all means reject everything else.

One SPF record per domain, maximum. If you already have one, merge Cyberfusion's include: into it. Do not add a second TXT record.

Also sending from another service — Mailgun, Postmark, your office mail server? Add its include: or IP to the same record. Otherwise receivers that enforce SPF reject that mail, and your visitors stop getting order confirmations and password resets.

DKIM: signs outgoing mail so receivers can verify it

DKIM adds a cryptographic signature to every outgoing message. The receiver looks up this DNS record for the matching public key, checks the signature, and knows the message was not forged or modified in transit.

Cyberfusion manages the key, so the CNAME is all you need. Key rotations happen on Cyberfusion's side.

Skip it and many receivers — Gmail and Outlook in particular — mark your outgoing mail as spam or reject it.

DMARC: what receivers do when SPF or DKIM fails

p=quarantine means put it in the spam folder. pct=100 means apply that to every such message.

Skip it and anyone can send mail pretending to be you@<your domain>, and most receivers still deliver it to the inbox. That damages your sender reputation and exposes your customers to phishing.

Mail client auto-configuration

These let Outlook, Thunderbird, Apple Mail and mobile apps configure themselves from just an email address and password.

Without them, users enter the settings manually: vmail.cyberfusion.nl for IMAP, POP3 and SMTP, with port 993 for IMAPS, 995 for POP3S, 587 for submission.

Autoconfig (Thunderbird, Apple Mail, most mobile clients)

Autodiscover (Outlook)

SRV records for IMAP, POP3 and SMTP submission

Some clients look up SRV records to find the server and port.

The format is <priority> <weight> <port> <target>.