DNS records explained

DNS records tell the rest of the internet where your domain's mail goes and who is allowed to send it. MailMoose generates three kinds for receiving, plus three more if you connect the domain for sending through Resend, and you add them at whichever registrar holds your domain.

All of them are safe to add at any time except one. Only the MX record changes where your mail is delivered.

The three record types

1. DKIM, three CNAME records. These publish the public half of a signing key. Receivers use them to confirm a message really came from your domain and was not altered in transit.
2. DMARC, one TXT record. This tells receivers what to do when a message fails DKIM or SPF.
3. MX, one record. This is the address other mail servers deliver to. Changing it moves your incoming mail.

Sending through Resend

These three cover SES, which is what receives your mail. If you also connect the domain to Resend, under Step 3, Enable sending via Resend on the domain's settings, it gives you three more records on their own subdomain: a DKIM CNAME, an SPF TXT record, and an MX record for bounce notifications. They never conflict with the three above, because they live on a different name.

A domain can be fully verified to receive with Resend never connected, or fully connected to Resend with receiving still pending. Neither blocks the other.

The mistake that catches everyone

Most registrars want only the part of the record name that comes before your domain, and they add the rest for you.

If MailMoose shows a record name like this:

abc123xyz._domainkey.learnfarsi.app

Then most registrars want only:

abc123xyz._domainkey

Paste the full name and you silently create abc123xyz._domainkey.learnfarsi.app.learnfarsi.app, which never verifies and produces no error message anywhere.

If a record refuses to verify after an hour, this is almost always why. Open the record at your registrar and check whether your domain appears twice.

No SPF record on your domain

MailMoose does not ask for an SPF record on your domain itself. The records it gives you for sending already cover SPF, on a name of their own.

If you added include:amazonses.com to your SPF record for MailMoose before, you can leave it. It does no harm. If your domain has SPF for other services, keep it as it is, as a single record: two SPF records invalidate each other.

How long changes take

1. Most records are live within a few minutes.
2. Some registrars take up to an hour.
3. Records you are replacing, such as MX, can take as long as their previous TTL, often one hour.

MailMoose checks each record independently against public DNS, so you can see which ones have taken effect and which have not.