# DNS records

> Every setting to add to your domain, on one page, with copy buttons, and a safe plan for tightening email protection without breaking your email.

Your logo depends on a few public settings on your domain, called [DNS records](https://getverifiedinbox.com/docs/glossary.md#dns-record). You add them where you manage your domain (for example Cloudflare, GoDaddy, Google Domains/Squarespace, Namecheap or Route 53). In the setup phase, the **DNS** step shows every record you need on one page, each with a copy button and a live status.

If someone else manages your domain, send them the link to the DNS step.

## The records

| Purpose | Type | Host (name) | Value |
|---|---|---|---|
| Prove you control the domain ([ownership check](https://getverifiedinbox.com/docs/glossary.md#domain-ownership)) | TXT | `_verifiedinbox` | `verifiedinbox-verification=…` (your unique code) |
| Tell inboxes to block fakes ([DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc)) | TXT | `_dmarc` | for example `v=DMARC1; p=quarantine; rua=mailto:…` |
| Point inboxes to your logo and certificate ([BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi)) | TXT | `default._bimi` | `v=BIMI1; l=https://bimi.getverifiedinbox.com/yourdomain.com/logo.svg; a=https://bimi.getverifiedinbox.com/yourdomain.com/certificate.pem` |
| Allowed senders ([SPF](https://getverifiedinbox.com/docs/glossary.md#spf)) | TXT | `@` (your domain) | usually already present; we advise changes if needed |
| Email signatures ([DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim)) | TXT or CNAME | `<selector>._domainkey` | set up in each service that sends email for you |

Your DNS step shows the exact values for your domain. Some DNS hosts want the full host name (`_dmarc.yourdomain.com`), others only the part before your domain (`_dmarc`); we show both.

## How to add a record

1. Sign in where you manage your domain and open its DNS settings.
2. Choose **Add record**, pick the type (usually **TXT**).
3. Paste the **host** and the **value** from the DNS step. Leave the time-to-live ([TTL](https://getverifiedinbox.com/docs/glossary.md#ttl)) at its default.
4. Save, then press **Check now** on the DNS step.

## Changes show up in seconds

Most tools wait for DNS changes to spread around the internet, which can take hours. We ask your domain's own servers directly ([authoritative nameservers](https://getverifiedinbox.com/docs/glossary.md#authoritative-dns)), so a correct record usually shows as done within seconds of saving it.

## Safe DMARC rollout

Logos only show when your DMARC policy tells inboxes to quarantine or reject fake email. How quickly you get there depends on how you use email on the domain; the email security step asks you.

**New domain, or little email sent:** publish the blocking record (`v=DMARC1; p=reject; rua=mailto:…`) straight away. There's little or nothing to break.

**Email sent every day:** switching protection on too fast can send your own newsletters, invoices or sales emails to spam, if one of the services sending email for you isn't set up yet. So we suggest four steps ([safe DMARC rollout](https://getverifiedinbox.com/docs/glossary.md#dmarc-rollout)):

| Stage | Record value (example) | Suggested time | What it does |
|---|---|---|---|
| 1. Watch | `v=DMARC1; p=none; rua=mailto:…` | 14 days | Watches only. Reports show every service sending as you. |
| 2. Filter some | `v=DMARC1; p=quarantine; pct=25; rua=mailto:…` | about a week | A quarter of failing mail goes to spam. |
| 3. Filter all | `v=DMARC1; p=quarantine; rua=mailto:…` | about a week | Failing mail goes to spam. **Enough for your logo.** |
| 4. Block all (recommended) | `v=DMARC1; p=reject; rua=mailto:…` | ongoing | Failing mail is refused. |

The times are suggestions: you can move ahead sooner if you accept the risk. The email security step shows the exact record for each stage, what to watch and what happens to your email.

## Checking your email setup

We keep four checks separate, so you always know what's done:

1. **Settings inspection** — your public records (free, any time).
2. **DKIM selectors** — signature keys for the services you name. Selectors can't be discovered automatically, so tell us yours (for example `google` or `selector1`) ([DKIM selector](https://getverifiedinbox.com/docs/glossary.md#dkim-selector)).
3. **A real test email** — send an email to the address we give you; we check that it passes and is [aligned](https://getverifiedinbox.com/docs/glossary.md#alignment) with your domain.
4. **Ongoing monitoring** — after you go live, we keep checking and alert you if something breaks.

## Common issues

- **Two SPF records.** Only one is allowed; merge them.
- **Too many SPF lookups.** SPF allows at most 10; remove services you no longer use.
- **DMARC on a subdomain only.** BIMI checks your main domain's policy too ([organizational domain](https://getverifiedinbox.com/docs/glossary.md#organizational-domain)).
- **Quotes or line breaks** pasted into the value. Paste the value exactly as shown.

## One-click DNS

Automatic DNS setup (for example with Cloudflare) isn't available yet. Copy-paste takes a few minutes, and we never ask for your DNS login.

## For developers

- `POST /v1/checks/email-auth` — free inspection with plain-English findings and `fix` suggestions.
- `GET /v1/applications/{id}/dns` — every record with `host`, `host_relative`, `type`, `value`, `current`, `status` (`ok`, `missing`, `mismatch`, `warning`), plus `nameservers` and `dns_host`.
- `POST /v1/applications/{id}/dns/verify` — re-check now against authoritative nameservers.
- `GET /v1/applications/{id}/email-health` — includes `dmarc_rollout` with the current stage, `next_stage`, `ready_to_advance` and the full plan.
- MCP: `check_email_security`, `get_dns_records`, `verify_dns`, `verify_dkim_selectors`, `create_test_message`, `get_test_message_result`.