ZEDMAIL FR Open Sending Domains →
ZEDMAIL Domain setup
Before your first send

Set up your sending domain

Zedmail signs and authenticates your mail so it reaches inboxes instead of spam. That requires three DNS records on your domain. Publishing them takes about five minutes; verification is automatic afterward.

!

This isn't optional. Zedmail will not send from a domain that hasn't been verified — every message from an unverified domain is rejected with domain_not_verified. Add all three records below, then verify, before you send.

Record 1 of 3

DKIM — two CNAME records

These let Zedmail cryptographically sign every email as you. Two selector slots (zm1 and zm2) let us rotate signing keys without you ever touching DNS again — publish both, once.

DKIM signatureCNAME · 2 recordsRequired
Type
CNAME
Name
zm1._domainkey.yourdomain.com
Value
zm1.dkim.zedmail.io
Type
CNAME
Name
zm2._domainkey.yourdomain.com
Value
zm2.dkim.zedmail.io
Replace yourdomain.com with the exact domain (or subdomain) you're sending from. The zm1/zm2.dkim.zedmail.io targets are the same for every customer and never change.
Record 2 of 3

SPF — one TXT record

Authorises Zedmail's servers to send for your domain. If you already have an SPF record, add the include to it — don't create a second SPF record, a domain may only have one.

SPF authorisationTXT · root of domainRequired
Type
TXT
Name
yourdomain.com  («@»)
Value
v=spf1 include:_spf.zedmail.io ~all
Already have SPF? Just insert include:_spf.zedmail.io before the ~all in your existing record — e.g. v=spf1 include:_spf.google.com include:_spf.zedmail.io ~all.
Record 3 of 3

DMARC — one TXT record

Tells inbox providers what to do with mail that fails authentication, and is now effectively required by Gmail and Yahoo. Start in monitor mode (p=none) — it changes nothing about delivery and gives you visibility.

DMARC policyTXT · start in monitor modeRequired
Type
TXT
Name
_dmarc.yourdomain.com
Value
v=DMARC1; p=none; rua=mailto:dmarc-XXXXXXXX@reports.zedmail.io

Replace dmarc-XXXXXXXX with the exact address shown on your Domains page — it is unique to each domain and is what routes the reports back to you. An address at your own domain will not work.

Once you've watched reports for a few weeks and see only your legitimate mail, tighten to p=quarantine; pct=100 to start protecting your domain from spoofers.
⚠️

On Cloudflare? Turn the proxy OFF for these records.

Set the two DKIM CNAMEs to “DNS only” (grey cloud), not the orange “Proxied” cloud. Cloudflare's proxy flattens CNAMEs and breaks DKIM verification — this is the single most common setup failure. TXT records (SPF, DMARC) are unaffected.

Last step

Verify, then you're live

# checking from your terminal, if you like:
dig +short zm1._domainkey.yourdomain.com CNAME
dig +short yourdomain.com TXT | grep spf1
dig +short _dmarc.yourdomain.com TXT
One more thing — and it matters

Verified ≠ trusted. Warm up.

Authentication gets you allowed to send; it doesn't make inbox providers trust a brand-new domain yet — Apple's iCloud especially will refuse it at first. Don't blast your full list on day one. Start with a small volume of genuinely wanted mail and ramp up over the first few weeks. Reputation is earned, not configured — and switching email providers won't skip that step. Warm up. Warm up. Warm up.