VerifiedInbox

Setting up

DNS records

Every setting to add to your domain, on one page, with copy buttons, and a safe plan for tightening email protection without breaking your email.

View as Markdown

Your logo depends on a few public settings on your domain, called DNS records. You add them where you manage your domain (for example Cloudflare, GoDaddy, Google Domains/Squarespace, Namecheap or Route 53). In the setup phase, the DNS step shows every record you need on one page, each with a copy button and a live status.

If someone else manages your domain, send them the link to the DNS step.

The records#

Purpose Type Host (name) Value
Prove you control the domain (ownership check) TXT _verifiedinbox verifiedinbox-verification=… (your unique code)
Tell inboxes to block fakes (DMARC) TXT _dmarc for example v=DMARC1; p=quarantine; rua=mailto:…
Point inboxes to your logo and certificate (BIMI) TXT default._bimi v=BIMI1; l=https://bimi.getverifiedinbox.com/yourdomain.com/logo.svg; a=https://bimi.getverifiedinbox.com/yourdomain.com/certificate.pem
Allowed senders (SPF) TXT @ (your domain) usually already present; we advise changes if needed
Email signatures (DKIM) TXT or CNAME <selector>._domainkey set up in each service that sends email for you

Your DNS step shows the exact values for your domain. Some DNS hosts want the full host name (_dmarc.yourdomain.com), others only the part before your domain (_dmarc); we show both.

How to add a record#

  1. Sign in where you manage your domain and open its DNS settings.
  2. Choose Add record, pick the type (usually TXT).
  3. Paste the host and the value from the DNS step. Leave the time-to-live (TTL) at its default.
  4. Save, then press Check now on the DNS step.

Changes show up in seconds#

Most tools wait for DNS changes to spread around the internet, which can take hours. We ask your domain's own servers directly (authoritative nameservers), so a correct record usually shows as done within seconds of saving it.

Safe DMARC rollout#

Logos only show when your DMARC policy tells inboxes to quarantine or reject fake email. How quickly you get there depends on how you use email on the domain; the email security step asks you.

New domain, or little email sent: publish the blocking record (v=DMARC1; p=reject; rua=mailto:…) straight away. There's little or nothing to break.

Email sent every day: switching protection on too fast can send your own newsletters, invoices or sales emails to spam, if one of the services sending email for you isn't set up yet. So we suggest four steps (safe DMARC rollout):

Stage Record value (example) Suggested time What it does
1. Watch v=DMARC1; p=none; rua=mailto:… 14 days Watches only. Reports show every service sending as you.
2. Filter some v=DMARC1; p=quarantine; pct=25; rua=mailto:… about a week A quarter of failing mail goes to spam.
3. Filter all v=DMARC1; p=quarantine; rua=mailto:… about a week Failing mail goes to spam. Enough for your logo.
4. Block all (recommended) v=DMARC1; p=reject; rua=mailto:… ongoing Failing mail is refused.

The times are suggestions: you can move ahead sooner if you accept the risk. The email security step shows the exact record for each stage, what to watch and what happens to your email.

Checking your email setup#

We keep four checks separate, so you always know what's done:

  1. Settings inspection — your public records (free, any time).
  2. DKIM selectors — signature keys for the services you name. Selectors can't be discovered automatically, so tell us yours (for example google or selector1) (DKIM selector).
  3. A real test email — send an email to the address we give you; we check that it passes and is aligned with your domain.
  4. Ongoing monitoring — after you go live, we keep checking and alert you if something breaks.

Common issues#

  • Two SPF records. Only one is allowed; merge them.
  • Too many SPF lookups. SPF allows at most 10; remove services you no longer use.
  • DMARC on a subdomain only. BIMI checks your main domain's policy too (organizational domain).
  • Quotes or line breaks pasted into the value. Paste the value exactly as shown.

One-click DNS#

Automatic DNS setup (for example with Cloudflare) isn't available yet. Copy-paste takes a few minutes, and we never ask for your DNS login.

For developers#

  • POST /v1/checks/email-auth — free inspection with plain-English findings and fix suggestions.
  • GET /v1/applications/{id}/dns — every record with host, host_relative, type, value, current, status (ok, missing, mismatch, warning), plus nameservers and dns_host.
  • POST /v1/applications/{id}/dns/verify — re-check now against authoritative nameservers.
  • GET /v1/applications/{id}/email-health — includes dmarc_rollout with the current stage, next_stage, ready_to_advance and the full plan.
  • MCP: check_email_security, get_dns_records, verify_dns, verify_dkim_selectors, create_test_message, get_test_message_result.