A custom domain lets you send and receive mail at your own address. You add the domain in SipherMail, then publish DNS records where your DNS is managed. SipherMail shows each record as a row with its type, host and value, a Copy button on every one, and a status.
Add a domain#
- Organisations: open the Org Panel, choose Domains, then Add a domain. Organisations also see this as the first steps of the setup checklist.
- Individuals on plans that include custom domains: open Settings > Custom Domains and choose Add Domain.
Enter your own domain, such as example.com, or a subdomain such as mail.example.com. Leave out http:// and www. A shared mail service such as a free webmail domain cannot be added, because you do not own it. If the domain is already set up on another SipherMail account, you are told so and can contact support to take it over.
Records to publish#
| Record | Type | Required | What it does |
|---|---|---|---|
| Ownership | TXT at _siphermail | Yes | Proves the domain is yours. It does not affect mail. |
| MX | MX | Yes | Points incoming mail to mail.siphermail.com. |
| SPF | TXT | Yes | Lists SipherMail’s server as allowed to send for your domain. |
| DKIM | TXT | Yes | Publishes the key receivers use to check your outgoing mail. |
| DMARC | TXT at _dmarc | Recommended | Tells receivers what to do with mail that fails the checks. |
| autoconfig | CNAME | Optional | Automatic setup in Thunderbird and Apple Mail. |
| autodiscover | CNAME | Optional | Automatic setup in Outlook. |
Notes:
- Publish the ownership record first. Until it is found, SipherMail does not report on the other records.
- If your domain already has an SPF record, edit it to add SipherMail’s entry. A domain must have only one SPF record, and two make receivers reject it.
- DKIM can appear as one or two TXT records. When there are two, the Ed25519 key is required and the RSA key is an extra for older systems. Publish both.
- Any valid DMARC record counts as found, including a policy of
none. SipherMail suggestsv=DMARC1; p=none;to start with. - Both optional CNAME records point to
mail.siphermail.com. - Copy values with the Copy buttons and leave out quotation marks. Long DKIM values are often cut off or split when typed by hand.
Where to add them#
Sign in where the DNS for your domain is managed. That is often your domain registrar, but it can be a separate DNS host or a website builder. Open its DNS settings (usually called DNS, DNS records or zone editor) and add one record for each row.
Some DNS settings want the full host name and others only the part before your domain, with @ meaning the domain itself. SipherMail shows the full host and, where it differs, a short form with its own Copy button.
If a record of the same type and host already exists, edit it instead of adding a second one.
Main domain or subdomain#
- Main domain (
example.com): MX and SPF go on the domain itself. Publishing the MX record sends new mail to SipherMail, so if people already receive mail at this domain somewhere else, publish it when you are ready to move. - Subdomain (
mail.example.com): add the records in the DNS settings of the main domain (example.com). The hosts SipherMail shows already include the subdomain, and the short form shows what to type, such asmailor_dmarc.mail. Mail for the main domain is not affected.
Check the records#
DNS changes can take a while to spread. Usually it is a few minutes. Some providers take a few hours, and an old record can stay cached until its TTL runs out. Choosing the lowest TTL while you set up helps.
Each record shows one of these:
| Status | Meaning |
|---|---|
| Verified | Found and correct. |
| Waiting | Not judged yet: it has not been checked, the lookup did not finish, or it waits for ownership to be verified first. |
| Wrong value | Something is published there but it differs. SipherMail shows what it found next to what it expected. |
| Missing | Checked and nothing was found at that host. |
The domain itself shows one of three words: Verified (ownership, MX, SPF and DKIM all pass), Waiting for DNS (records are not all there yet) or Needs action (a record has a wrong value, the mail server has not finished setting the domain up, or a record has been missing for more than two days).
- Individuals choose Check DNS on the domain page. The rest of this section describes the Org Panel.
- Choose Check now to look right away. After a check you can check again in 10 seconds.
- While the domain is not verified and the page is open and visible, SipherMail checks again by itself every 30 seconds. It pauses while the tab is hidden and stops after 15 minutes with a message. Choose Keep checking to start another 15 minutes.
- Add records for me can create the records through your DNS provider’s API. You paste a token that is used once and never stored. Adding the records by hand always works too.
Once ownership, MX, SPF and DKIM pass, the domain is verified. A domain that was verified and later breaks raises an alert in the Org Panel. Removing a domain stops any addresses on it from working, and a domain cannot be removed while mailboxes still use it.