Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Customer.io account: copy it from Customer.io's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| Bounces (MAIL FROM) | MX | cio{account-number}.{domain} | priority 10 · mxa.mailgun.orgCustomer.io shows the exact records per sending domain; on Route 53, put both MX values in one record set. |
| Bounces (MAIL FROM) | MX | cio{account-number}.{domain} | priority 10 · mxb.mailgun.org |
| SPF | TXT | cio{account-number}.{domain} | v=spf1 include:mailgun.org ~allOn the account subdomain, not your root, so it doesn't count toward your root record's lookup limit. |
| DKIM | TXT | {selector}._domainkey.cio{account-number}.{domain} | k=rsa; p={public-key}Copy the selector and key from Customer.io; the 2048-bit key must be split into quoted strings. |
| SPFApple Private Email Relay only optional | TXT | {domain} | v=spf1 include:mailgun.org ~allOnly for Sign in with Apple relay addresses; if the domain already has SPF, add include:mailgun.org to it. |
| DMARC | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address}Checked by Customer.io since February 1, 2024; publish it on the root domain only and keep alignment relaxed. |
SPF
Not at your root: SPF goes on the account subdomain cio{account-number}.{domain}, which is the Return-Path, as v=spf1 include:mailgun.org ~all, and it aligns with a From address on {domain} under relaxed alignment (aspf=r). Customer.io asks for include:mailgun.org on the From domain only to pass Apple's Private Email Relay check.
DKIM
One TXT record with a 2048-bit RSA key under a selector shown in the app (Customer.io's examples use cio and smtp), on the account subdomain: {selector}._domainkey.cio{account-number}.{domain}. Customer.io checks the records only when you click Verify domain.
DMARC alignment
Relaxed only: Customer.io sets the Return-Path and signs DKIM on cio{account-number}.{domain}, so both align with a From address on {domain} under relaxed alignment. A strict policy (adkim=s or aspf=s) makes Customer.io mail fail DMARC.
Common mistakes
- Strict DMARC alignment (adkim=s or aspf=s) breaks Customer.io's built-in sending.
- The DKIM key lives under cio{account-number}.{domain}, so looking up the selector on your From domain won't find it.
- Customer.io says to publish _dmarc only on the root domain, not on subdomains.
- Customer.io verifies only when you click Verify domain, so deleting the records later causes bounces or spam filtering without a warning in the app.
- GoDaddy-style hosts append the domain, so enter just cio12345 as the host.
- Wix can't add MX records on a subdomain, so verification fails there.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed: