Configuring Records for Automated Outbound Email Delivery

Why this is important

Starting February 2024, Google LLC and Yahoo Inc. require bulk-senders to have a valid DMARC in place. From May 5, 2025, Microsoft Corporation will enforce the same requirement.
For you as a reseller, this means if your technical contact domain isn’t configured correctly, account notification emails (renewals, expirations, etc) may fail to reach end-users or be filtered out.

In short:

• You must publish a DMARC record for the domain used in your technical contact email.
• You must publish DKIM records (via CNAMEs) for that domain to support automated outbound notices.
• Your email must pass both SPF and DKIM aligned with the From: header domain.

Identify your Technical Contact Domain

Before you add DNS records, you need to know exactly which domain your technical contact email uses (that domain must carry the DKIM + DMARC).

1. Log in to the Reseller Control Panel (RCP).
2. Navigate to the Domains tab. In the settings section you’ll see the default “Technical Contact” email.
3. Extract the domain portion of that email (for example, if the email is domain@myreseller.com, the domain is myreseller.com).
4. All further DNS records (DMARC & DKIM) must be applied to that domain (or a sub-domain if specified) so that notices sent from your reseller-platform are properly validated.

Summary of Required Records

• Record type: SPF (TXT)
  Hostname: @    Value: v=spf1 include:_spf.hostedemail.com include:registrarmail.net ~all

• Record type: CNAME
  Hostname: key1._domainkey.example.com      Value: key1.example.com.dkim.hostedemail.link
  Hostname: key2._domainkey.example.com      Value: key2.example.com.dkim.hostedemail.link

• Record type: DMARC (TXT)
  Hostname: _dmarc   Value: v=DMARC1; p=none;

Configure DKIM for Automated Outbound Emails

For the technical contact domain, you must add the following two CNAME records. These allow the system to sign outbound notices with DKIM, thereby helping validation and improving inbox placement.

Records to add (replace example.com with your technical contact domain):

Steps:

1. Log in to your Reseller Control Panel (RCP).
2. Go to the Domains tab, search for your technical-contact domain.
3. Click on the domain → Edit DNS section.
4. Add a subdomain for each of the hostnames above.
   One example record:
    
5. For each, select CNAME and set the Address/Value as shown.
6. Save the DNS settings.

Notes / Tips:

• Both records (key1 + key2) are required.
• If your DNS provider prepends the domain name automatically, you may omit the full domain on the host field (check how your provider handles sub-domains).
• After propagation, you may want to test DKIM signing via a mail-header check or DKIM validator.

Publish DMARC (and ensure SPF alignment)

In addition to DKIM, your domain must publish a valid DMARC record and ensure that SPF covers the sending infrastructure. This is now mandatory for bulk-senders per Google, Yahoo and Microsoft.

Record to add (modify the “mailto:” addresses as desired):

Host: _dmarc.example.com  Type: TXT  Value: v=DMARC1; p=none; rua=mailto:reports@example.com; ruf=mailto:forensics@example.com; fo=1

Example (minimum required):

v=DMARC1; p=none;

Also ensure an SPF record exists such as (minimum required):

v=spf1 include:_spf.hostedemail.com include:registrarmail.net ~all

(where “_spf.hostedemail.com” is the provider’s include domain)

Steps to publish DMARC:

1. In RCP or your DNS provider, locate the DNS settings for your technical contact domain.
2. Add a new sub-domain _dmarc (i.e., _dmarc.example.com).
3. Choose type TXT.
4. Paste the DMARC value (as above). Click save.
5. If you haven’t already, ensure SPF record exists and is aligned with your sending domain.

Tips:

• Using p=none is a safe starting policy; you can later move to p=quarantine or p=reject once you verify sending.
• The rua and ruf tags allow you to receive aggregate and forensic reports from receiving mail servers.
• Make sure the “From” header domain, envelope-from (bounce domain) and DKIM domain all align, as required by DMARC.

Summary & Checklist

At a glance, here’s what you need to do:

• Identify your technical contact email domain (from RCP).
• Add two CNAME DKIM records for that domain (key1 and key2).
• Add a TXT DMARC record under _dmarc.domain.
• Ensure an SPF record exists and includes the sending infrastructure (e.g., include:_spf.hostedemail.com).
• Save DNS changes and allow propagation (may take up to 24-48 hours).
• Optionally test: send a notice, inspect headers to confirm DKIM pass, SPF pass and DMARC alignment.

Why this matters for your Notices

Because you—via your technical contact domain—are sending account-related notices on behalf of the platform, these records ensure that major mailbox providers treat those messages as legitimate. Mis-configuration may result in:

• Your messages landing in spam or junk folders.
• Messages being rejected outright by recipient systems (especially once Microsoft enforces this).
• Lack of report-data if DMARC isn’t configured (meaning no visibility into issues).

Additional Resources

• The Gmail, Microsoft, and Yahoo DMARC requirements on the hosted email platform 
• How to configure DKIM for Automated Outbound emails

By performing the above steps, you are taking the correct proactive measures to maintain deliverability, system trust and compliance with major mailbox provider requirements.

Was this article helpful? If not please submit a request here