FastmailSPF, DKIM & DMARC Setup
Fastmail custom domains use two MX hosts and three DKIM CNAMEs (fm1–fm3). If you use Fastmail's own DNS hosting, all of this is configured automatically — these records are for domains hosted at an external DNS provider.
Already set up? Check what your domain publishes right now — SPF, DKIM (fm1, fm2, fm3), DMARC, MX, BIMI, and MTA-STS in one scan.
Run a free domain check →1. SPF record
Publish as a TXT record on your root domain. One SPF record per domain.
TXT record
v=spf1 include:spf.messagingengine.com ~all2. DKIM (selectors: fm1, fm2, fm3)
Create three CNAMEs: fm1._domainkey → fm1.yourdomain.com.dkim.fmhosted.com (and the same pattern for fm2, fm3). Fastmail's Settings → Domains screen shows the exact targets and validates them live.
3. MX records
| Host | Priority |
|---|---|
| in1-smtp.messagingengine.com | 10 |
| in2-smtp.messagingengine.com | 20 |
Verify with the MX Record Lookup tool.
4. DMARC record
Start at p=none with rua reporting, tighten once reports are clean for a few weeks.
TXT record at _dmarc.yourdomain.com
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comFastmail authentication FAQ
Do I need these records if Fastmail hosts my DNS?
No — if your domain's nameservers point at Fastmail, SPF, DKIM, and MX are managed automatically. These records only need manual setup when DNS is hosted elsewhere (Cloudflare, Route 53, your registrar).
Official documentation: Fastmail email authentication docs ↗
Verify your setup
DNS Email Diagnostics
SPF, DKIM, DMARC, MX, BIMI & MTA-STS in one check
MX Record Lookup
See exactly which mail servers your domain publishes
BIMI Validator
Show your logo in Gmail & Yahoo once DMARC is enforced
Deliverability Monitoring
Daily checks + email alerts when a record changes or breaks