OpenSRS sends account notices, such as renewal and expiration reminders, to your end users using your reseller technical contact domain as the From address. Major mailbox providers now require these messages to pass authentication checks, so you need to publish DNS records on that domain. This article walks you through identifying your technical contact domain and adding the SPF, DKIM, and DMARC records that keep your automated notices reaching the inbox.
About these requirements
Since February 2024, Google and Yahoo have required bulk senders to publish a valid DMARC record. As of May 5, 2025, Microsoft enforces the same requirement. If your technical contact domain is not configured correctly, account notification emails may be filtered into spam or rejected outright.
To meet these requirements, the domain used in your technical contact email must do three things: publish a DMARC record, publish DKIM records (as CNAMEs) so outbound notices can be signed, and have an SPF record that authorizes the sending infrastructure. Authentication must align with the From header domain.
For background on the provider requirements, see DMARC requirements on the hosted email platform.
Summary of required records
Replace example.com with your own technical contact domain in every value below.
Record type | Hostname | Value |
|---|---|---|
SPF (TXT) | @ | v=spf1 include:_spf.hostedemail.com include:registrarmail.net ~all |
CNAME | key1._domainkey.example.com | key1.example.com.dkim.hostedemail.link |
CNAME | key2._domainkey.example.com | key2.example.com.dkim.hostedemail.link |
DMARC (TXT) | _dmarc | v=DMARC1; p=none; |
Step 1: Identify your technical contact domain
Before adding any DNS records, confirm exactly which domain your technical contact email uses. That domain must carry the DKIM and DMARC records.
- Log in to the Reseller Control Panel (RCP).
- Go to the Domains tab and locate the default Technical Contact email in the settings section.
- Take the domain portion of that email address. For example, if the email is domain@myreseller.com, the domain is myreseller.com.
Note: Apply all of the DNS records in this article to that exact domain (or a subdomain if one is specified) so notices sent from your reseller platform validate correctly.
Step 2: Add the DKIM CNAME records
Add two CNAME records to your technical contact domain. These let the platform sign outbound notices with DKIM, which improves inbox placement.
- In the Reseller Control Panel (RCP), go to the Domains tab and search for your technical contact domain.
- Click the domain, then open the Edit DNS section.
- Add a record for hostname key1._domainkey.example.com, set the type to CNAME, and enter the value key1.example.com.dkim.hostedemail.link.
- Add a second record for hostname key2._domainkey.example.com, set the type to CNAME, and enter the value key2.example.com.dkim.hostedemail.link.
- Save the DNS settings.
Note: Both records, key1 and key2, are required. If your DNS provider appends the domain name to the host field automatically, enter only the subdomain portion.
Step 3: Publish the DMARC record
Publish a DMARC record on your technical contact domain. A policy of p=none is a safe starting point that monitors without affecting delivery.
- In the Reseller Control Panel (RCP) or your DNS provider, open the DNS settings for your technical contact domain.
- Add a record on the subdomain _dmarc (so the full host is _dmarc.example.com).
- Set the type to TXT.
- Enter the value. The minimum required record is v=DMARC1; p=none;. To receive aggregate and forensic reports, use a fuller value such as v=DMARC1; p=none; rua=mailto:reports@example.com; ruf=mailto:forensics@example.com; fo=1.
- Save the record.
Tip: Once you confirm your mail is signing and passing correctly, you can tighten the policy from p=none to p=quarantine or p=reject.
Step 4: Confirm SPF alignment
Make sure an SPF record exists on the domain and authorizes the OpenSRS sending infrastructure.
- In your DNS settings, check for a TXT record on the root of the domain (@).
- Confirm it includes the OpenSRS sending hosts. The minimum required value is v=spf1 include:_spf.hostedemail.com include:registrarmail.net ~all.
- If no SPF record exists, add one with the value above, then save.
Warning: DMARC requires alignment. Make sure the From header domain, the envelope-from (bounce) domain, and the DKIM signing domain all match, or messages may still fail DMARC even with valid records in place.
Step 5: Allow propagation and test
DNS changes can take time to spread across the internet before they take effect.
- Allow up to 24 to 48 hours for the new records to propagate.
- Send a test notice and inspect the message headers to confirm that SPF passes, DKIM passes, and DMARC aligns.
Next steps
- Review the provider requirements. Read DMARC requirements on the hosted email platform to understand what each mailbox provider enforces.
- Set up DKIM for customer domains. If you also host email for end users, see Setting Up DKIM for Hosted Email Domains.
- Review your SPF configuration. See Sender Policy Framework (SPF) for the full list of OpenSRS sending hosts and IP ranges.
Questions? Contact OpenSRS Support.
How helpful was this article?
Thanks for your feedback!
Do you still need help? If so please submit a request here.