Fastmail Custom Domain: SPF, DKIM & DMARC Setup

Fastmail hosts mail for your own domain, but it cannot edit your DNS. You add the domain in Settings, Fastmail shows you a short list of records, and you publish them wherever the domain's DNS lives. Until those records exist, mail either does not arrive or arrives without authentication.

The whole job takes about fifteen minutes. This guide covers the records Fastmail currently documents, the order to add them, and how to confirm the domain shows as active.

What you need

• A paid Fastmail plan that includes custom domains.
• Login access to your DNS provider, or the registrar's control panel.
• The domain already registered. Fastmail's wizard checks registration before it issues instructions.
• Fifteen minutes, and no expectation of instant propagation — most changes appear within minutes, but allow a few hours.

Step 1: add the domain in Fastmail

In Fastmail, open Settings and go to Domains. Click Add domain, choose the option to use a domain you already own, and enter it. Follow the wizard through creating your addresses. At the end, Fastmail generates instructions matching your setup.

If you also have a website on the domain, do not move the nameservers to Fastmail. Choose the option to keep your DNS where it is and add individual records. Moving nameservers takes the site's records with it.

Step 2: point MX at Fastmail

Two MX records route incoming mail. Priorities matter: lower is tried first.

@   MX   10   in1-smtp.messagingengine.com
@   MX   20   in2-smtp.messagingengine.com

Delete MX records left by a previous provider. Mail follows whichever MX records exist, so a leftover entry sends part of your mail somewhere you no longer read.

Step 3: publish SPF

Fastmail's documented record uses a neutral qualifier:

@   TXT   v=spf1 include:spf.messagingengine.com ?all

The ?all means "no assertion" about other senders, which is Fastmail's conservative default. Some guides show ~all instead. Both are valid; ~all marks unauthorized senders as soft failures and is a reasonable tightening once you are certain nothing else sends for the domain. What you must not do is publish a second v=spf1 record — if one already exists, merge the include into it:

v=spf1 include:spf.messagingengine.com include:spf.example.com ~all

Check the result with the SPF Checker. It counts the DNS lookups the include consumes, which matters if you also route through a newsletter or ticketing platform.

Step 4: add the three DKIM CNAMEs

Fastmail signs with three selectors so keys can be rotated without asking you to change DNS. Add all three CNAMEs — a missing one means some mail leaves unsigned.

fm1._domainkey   CNAME   fm1.yourdomain.com.dkim.fmhosted.com
fm2._domainkey   CNAME   fm2.yourdomain.com.dkim.fmhosted.com
fm3._domainkey   CNAME   fm3.yourdomain.com.dkim.fmhosted.com

Copy the target values from your own Fastmail screen: each one contains your domain name in the middle, so a value copied from a blog post will point at someone else's key. Fastmail's older domains may still carry a mesmtp._domainkey record; leave it in place if the interface lists it.

Cloudflare users: set these CNAMEs to DNS only. An orange-cloud proxied CNAME cannot be queried as a TXT key and DKIM verification will fail.

Step 5: publish DMARC yourself

Fastmail does not manage your DMARC policy. Add a TXT record at _dmarc:

_dmarc   TXT   v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start at p=none even though your setup is simple — the record also asks receivers to send reports, and those reports are how you find out that a contact form or an old mailing list is still sending as your domain. After a few clean weeks, move to p=quarantine, then p=reject. The DMARC Generator produces the record if you want the syntax checked.

Verify the setup

Return to Settings, then Domains, and click Recheck DNS. The domain should report as active with MX records found. Then send a message from Fastmail to a Gmail address and use Show original: you want spf=pass, dkim=pass and dmarc=pass.

From outside, confirm each record with the DKIM Checker — run it once per selector, fm1, fm2 and fm3 — plus the DMARC Lookup and MX Lookup. A single Email Health Check covers the lot.

Common mistakes

1. Only adding one DKIM selector. Mail signed with fm2 or fm3 fails verification if that CNAME is missing.
2. Leaving the CNAME proxied at Cloudflare. DKIM lookups need the real target, not Cloudflare's edge.
3. Keeping the old provider's MX records. Partial delivery is worse than an outage because it is silent.
4. Two SPF records. Adding Fastmail's record next to an existing one invalidates both. Merge the includes.
5. Publishing p=reject immediately. Any forgotten sender — a printer, a website form — starts bouncing without warning.

Frequently asked questions

Is ?all or ~all correct for Fastmail?

Fastmail documents ?all. ~all is a stricter alternative that many administrators prefer once they have confirmed every sender. Neither affects DMARC alignment, which is what actually protects the domain.

Do I need all three DKIM selectors?

Yes. Fastmail may sign with any of them, and the set exists so keys can rotate without DNS changes. Adding only fm1 leaves some messages unverifiable.

Can I use Fastmail with my existing website host?

Yes. Keep your nameservers where they are and add only the mail records. Moving nameservers to Fastmail would also move your website DNS.

Why does Fastmail still show the domain as unchecked?

Either propagation is incomplete or a value differs by one character. Recheck after an hour, and compare each record against the values in your own Domains screen rather than a tutorial.