Phase 10: Publish DNS records

After the mailbox and listeners are ready, publish the MX and authentication records.

Stalwart can generate a full DNS zone file. Not every generated entry must be used.

10.1 Core records

Type: A
Name: mail
Value: 203.0.113.10

Type: MX
Name: root/apex
Priority: 10
Value: mail.example.com.

The exact root-domain representation depends on the DNS provider. It may be:

or a blank Name field.

Verify:

dig +short MX example.com

Expected:

10 mail.example.com.

SPF tells recipients which servers may send mail for a domain.

At the root domain:

Type: TXT
Name: root/apex
Value: v=spf1 mx -all

For the mail hostname:

Type: TXT
Name: mail
Value: v=spf1 a -all

There must be only one SPF record at each exact hostname.

If a separate application-mail provider uses a subdomain such as:

send.example.com

its SPF record can remain separate because it applies to a different hostname.

Stalwart may generate RSA and Ed25519 DKIM selectors.

Examples:

v1-ed25519-YYYYMMDD._domainkey
v1-rsa-YYYYMMDD._domainkey

Publish the exact TXT values generated by Stalwart.

An Ed25519 record resembles:

v=DKIM1; k=ed25519; h=sha256; p=PUBLIC_KEY

An RSA record resembles:

v=DKIM1; k=rsa; h=sha256; p=LONG_PUBLIC_KEY

Long RSA TXT records may be displayed by dig as multiple quoted strings:

"first part" "second part"

That is normal DNS TXT chunking. Receivers combine the pieces.

Never publish or share a DKIM private key.

Start with:

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:postmaster@example.com

Keep this monitoring policy while testing.

DMARC is explained in detail later in this guide.