Lookproof Browse tools

DMARC, SPF and DKIM for Fastmail

Updated 2026-11-06

Fastmail hosts mail for your own domain. You can move your nameservers to Fastmail, or keep DNS at another host and point only the MX records at Fastmail. This guide covers the second case, where you publish SPF, DKIM and DMARC yourself. The values come from Fastmail's help centre, mainly its "Setting up your domain: MX only" and "Manual DNS configuration" pages. For the background on each standard, see SPF explained, DKIM explained and DMARC explained.

What Fastmail sends from

You add the domain under Settings → Domains, with Add or buy domain and then Use a domain you already own. At least one admin of the account must be on a non-Basic plan. Mail you send as [email protected] then leaves through Fastmail's servers, with your own domain in the visible From address.

As of November 2026 the documented MX records are:

example.com MX 10 in1-smtp.messagingengine.com
example.com MX 20 in2-smtp.messagingengine.com

Fastmail also offers regional MX servers "for customers who prefer to point their domain to servers located where their data resides". MX records only control inbound mail, not who may send.

On signing, Fastmail's page on the email delivery process says: "all outbound mail is DKIM signed with a messagingengine.com key, and additionally (if possible) with a key from the domain of the sending email address." Fastmail signs with a messagingengine.com key on every message. Once the CNAMEs are in place it also signs, when possible, with a key under your domain (d=example.com). Check the DKIM-Signature headers of a test message.

The help centre does not state which domain appears as the envelope sender (Return-Path) of mail you send from a custom domain. It does tell you to publish its SPF include on example.com itself, and on each subdomain you send from. Check the Return-Path header of a test message to see the envelope domain for your own mail.

SPF

Publish one TXT record on the domain itself. The docs say the host can be entered as @ if your DNS provider asks for one. As of November 2026 the documented value is:

example.com TXT "v=spf1 include:spf.messagingengine.com ?all"

Fastmail's docs say this record "allows receivers to know you send your mail via Fastmail, and other servers". Note the ?all at the end. That is the neutral result, not softfail or fail. Our checks report it as a warning, because it tells receivers nothing about servers you did not list. Fastmail documents ?all, and DMARC at p=reject acts on unaligned mail either way.

Only one SPF record per name is allowed. Fastmail puts it this way: "having more than one TXT record starting with v=spf1 will cause an issue with SPF detection." To add another service, put its include between v=spf1 and all. A typical setup with Fastmail plus one other service looks like this, where _spf.example.net is a placeholder for that other service's include:

example.com TXT "v=spf1 include:spf.messagingengine.com include:_spf.example.net ?all"

That record uses 2 DNS lookups itself. Each include then adds the lookups inside its own record. Fastmail does not document a number for include:spf.messagingengine.com. When we counted it with real DNS on 7 November 2026, that record held only IP ranges, so it cost 1 lookup in total. Fastmail can change it, so count your whole tree with the SPF lookup counter. The docs say "You can include up to 10 SPF records". The limit in RFC 7208 is 10 DNS lookups for the whole evaluation, nested includes counted, so ten includes will usually be too many (too many SPF lookups).

If you send from a subdomain such as news.example.com, the docs give the same SPF value as a TXT record on that subdomain.

DKIM

Fastmail signs your mail and hosts the keys. You publish CNAME records that point at them. As of November 2026 the documented records are:

fm1._domainkey.example.com CNAME fm1.example.com.dkim.fmhosted.com
fm2._domainkey.example.com CNAME fm2.example.com.dkim.fmhosted.com
fm3._domainkey.example.com CNAME fm3.example.com.dkim.fmhosted.com

The docs write the target as fm1.{mydomain.com}.dkim.fmhosted.com, with your domain in the middle. The docs are explicit: "you'll need to add all three CNAME records."

Steps, as documented:

  • In Fastmail, go to Settings → Domains, click your domain and click Get Instructions. The docs say this shows step-by-step instructions for your domain.
  • At your DNS host, add three CNAME records with the host names fm1._domainkey, fm2._domainkey and fm3._domainkey.
  • Set each target to the matching name under dkim.fmhosted.com, with your domain in place of {mydomain.com}.
  • On Cloudflare, set the proxy status of each record to grey, which Cloudflare labels DNS only. Fastmail says the orange cloud must be off so the records can be detected.
  • Back in Settings → Domains, use Recheck DNS. A green tick means Fastmail detected the records.

For a sending subdomain, the docs use host names like fm1._domainkey.news with the target fm1.news.example.com.dkim.fmhosted.com.

Domains hosted at Fastmail before 2018 may still use a deprecated selector, mesmtp._domainkey, pointing at mesmtp.example.com.dkim.fmhosted.com. As of November 2026 Fastmail does not document the key type or key length, and it describes no way to choose or rotate keys yourself.

If DKIM is missing, the docs say you may see a warning banner when you send, and the domain shows as Needs attention on Settings → Domains.

DMARC alignment

DMARC passes when SPF or DKIM passes and the authenticated domain aligns with the From domain.

  • DKIM alignment compares the d= domain with the From domain. With the three CNAMEs in place, Fastmail also signs, when possible, with a key under example.com; that signature carries d=example.com and aligns. The messagingengine.com signature does not align with example.com.
  • SPF alignment compares the RFC5321.MailFrom (Return-Path) domain with the From domain. The docs do not name the envelope domain for custom domains, so check a test message. SPF aligns only if that domain is example.com or one of its subdomains.

Relaxed alignment, the default, only needs the same organisational domain, so news.example.com aligns with example.com. Strict alignment needs the exact same name. DKIM through the CNAMEs gives an exact match, so it works in both modes.

Without the DKIM CNAMEs, alignment rests on SPF alone. Fastmail's sender authentication page notes that SPF breaks when mail is forwarded, while DKIM-signed mail can be forwarded "as long as the process of forwarding doesn't alter any of the signed message headers".

Step by step to p=reject

  1. Add the domain and MX. Add the domain in Settings → Domains and set the MX records.
  2. Publish SPF. Add one TXT record on example.com with include:spf.messagingengine.com, merged with the includes of every other service that sends as your domain. Keep the whole record at 10 DNS lookups or fewer.
  3. Publish the DKIM CNAMEs. As of November 2026, add all three records, fm1._domainkey, fm2._domainkey and fm3._domainkey, each pointing at the matching name under dkim.fmhosted.com. Confirm the green tick in Settings → Domains.
  4. Start DMARC at p=none with reports. Fastmail's documented record is v=DMARC1; p=none; with no report address. Publish a TXT record at _dmarc.example.com with v=DMARC1; p=none; rua=mailto:[email protected] instead. This policy does not protect the domain yet; it turns on aggregate reports.
  5. Read the reports and fix other senders. For two to four weeks, look at which servers send as your domain. Give every legitimate service SPF and, where it offers it, DKIM for your domain, so that its mail aligns too.
  6. Move to quarantine. Change the policy to p=quarantine once reports show only aligned mail from your own services. Failing mail is now usually placed in spam, so a sender you missed is still recoverable.
  7. Reject. Change the policy to p=reject when the reports stay clean. Receivers then refuse mail that fails DMARC.

The record for step 4:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

The final record:

_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

Fastmail's DMARC page says you add the record "in the control panel of your domain host" as a TXT record for _dmarc.yourdomain.com, with p=none, p=quarantine or p=reject.

Common mistakes

  • Two SPF records. Fastmail warns that more than one v=spf1 record causes an issue with SPF detection. Receivers return a permanent error when they find more than one (multiple SPF records).
  • Only one or two DKIM CNAMEs. As of November 2026 the docs ask for all three. A missing selector means messages signed with it fail DKIM for your domain (DKIM not found).
  • Cloudflare proxy on. Fastmail asks you to toggle the orange cloud to grey on the DKIM CNAMEs "so that your DNS can be correctly detected". Its Cloudflare page adds that this turns off CNAME flattening.
  • The domain typed twice. Many DNS hosts append the domain to the host name. Entering fm1._domainkey.example.com there creates fm1._domainkey.example.com.example.com. Fastmail's own tables use the short form fm1._domainkey.
  • Copying the DMARC record without rua. Fastmail's sample v=DMARC1; p=none; asks for no reports. Without rua you cannot see other senders before you tighten the policy (DMARC without rua).
  • Staying at p=none. Fastmail's sample record, which is also the one it generates when it hosts your DNS, is p=none. That policy asks receivers to take no action, so it does not stop spoofing (DMARC policy none).
  • Relying on a test flag. Some receivers support a test flag: t=y in RFC 9989 (DMARCbis), which obsoletes RFC 7489, or pct in RFC 7489. Neither is a safety net. RFC 7489 says unknown tags must be ignored, so a receiver that implements only RFC 7489 can treat p=reject; t=y as a full reject. Move from p=none to p=quarantine to p=reject and let the reports decide each step.

How to check it

Run the email security check on your domain. It reads SPF, DKIM and DMARC in one pass. Use the SPF lookup counter to count every lookup behind include:spf.messagingengine.com and your other includes. In the DKIM selector finder, look for the selectors documented as of November 2026: fm1, fm2 and fm3, plus mesmtp on domains set up before 2018. Each should resolve through its CNAME to a key. Build or check your policy with the DMARC record generator.

Sources

Frequently asked questions

What SPF record does Fastmail document?

As of November 2026 the help centre gives v=spf1 include:spf.messagingengine.com ?all as a TXT record on the domain itself (@). If another service also sends for your domain, add its include to the same record. Fastmail warns that more than one TXT record starting with v=spf1 causes an issue with SPF detection.

Which DKIM selectors does Fastmail use?

As of November 2026 Fastmail documents three CNAME records, fm1._domainkey, fm2._domainkey and fm3._domainkey, pointing at fm1.example.com.dkim.fmhosted.com and so on. The docs say you need to add all three. Domains hosted at Fastmail before 2018 may still use the deprecated mesmtp selector.

Do I have to set up anything if Fastmail hosts my DNS?

Not for delivery. Fastmail sets DKIM automatically and publishes p=none. To get protection, disable that DMARC record and create one with reporting, then move it to quarantine and reject.

Why does the Fastmail SPF record end in ?all?

?all is the SPF neutral result: it makes no statement about servers that are not listed. Fastmail gives no reason beyond saying the record covers 'Fastmail, and other servers'. For DMARC it matters little, because DMARC decides what happens to mail that fails, based on aligned SPF or DKIM.