Setup guide
Fastmail: SPF, DKIM and DMARC
Fastmail hosts your mailboxes. Keeping DNS elsewhere means two MX records, an SPF include, three DKIM CNAMEs (fm1, fm2, fm3) and a DMARC record.
By Ahmet Karaca · Updated · Checked against Fastmail documentation on
DNS records to add
@10 in1-smtp.messagingengine.comPrimary incoming mail server
@20 in2-smtp.messagingengine.comSecondary incoming mail server
@v=spf1 include:spf.messagingengine.com ?allSPF: authorizes Fastmail's servers to send as your domain
fm1._domainkeyfm1.<your domain>.dkim.fmhosted.comReplace the part in angle brackets with your own value before publishing.
DKIM key 1
fm2._domainkeyfm2.<your domain>.dkim.fmhosted.comReplace the part in angle brackets with your own value before publishing.
DKIM key 2
fm3._domainkeyfm3.<your domain>.dkim.fmhosted.comReplace the part in angle brackets with your own value before publishing.
DKIM key 3
_dmarcv=DMARC1; p=none;DMARC policy (Fastmail's suggested starting record)
Steps
- In Fastmail open Settings → Domains, click Add or buy domain and choose Use a domain you already own.
- At your DNS host, set the two MX records so they are the only MX records on the domain.
- Publish the SPF TXT record, the three fm CNAME records and the DMARC record.
- Back in Settings → Domains, click the domain. A green tick means Fastmail found every record; a red exclamation point comes with a fix.
Common mistakes
- Publishing only fm1._domainkey leaves DKIM incomplete. Fastmail asks for all three CNAME records: fm1, fm2 and fm3.
- MX records left over from your previous provider compete with Fastmail's. in1-smtp and in2-smtp.messagingengine.com must be the only two MX records.
- With Cloudflare's orange-cloud proxy on, Fastmail can't detect the fm CNAMEs. Toggle them to grey (DNS only).
- Sending from addresses on a subdomain needs its own fm1–fm3 CNAMEs (fm1._domainkey.<subdomain> and so on) and its own SPF record on that subdomain.
- Some DNS providers alter MX hostnames entered without a trailing dot. Fastmail suggests trying in1-smtp.messagingengine.com first and adding the dot only if the provider appends anything.
Good to know
- If you move your nameservers to Fastmail instead, Fastmail configures mail, DKIM and SPF for the domain automatically.
- Fastmail also runs regional MX servers: eu1-smtp and eu2-smtp.messagingengine.com in the EU, us1-smtp and us2-smtp.messagingengine.com in the US. Using them is optional.
Frequently asked questions
How long until mail starts arriving at Fastmail?
Usually minutes. Depending on the TTL of your old DNS records, it can take up to a day.
Is a DMARC policy required for my domain to work with Fastmail?
No. Fastmail says a DMARC policy isn't needed for the domain to work, but you're welcome to publish one; its manual DNS page suggests v=DMARC1; p=none;.
What is the mesmtp._domainkey record?
A deprecated DKIM CNAME that only domains hosted at Fastmail before 2018 still use. Newer domains use fm1, fm2 and fm3.
Which Fastmail plans can use a custom domain?
At least one admin on the account must be on a plan other than Basic.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Fastmail documentation.
Check your Fastmail setup
Or open the SPF checker, DKIM checker or DMARC checker directly.