Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Fastmail account: copy it from Fastmail's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| Receiving mail | MX | {domain} | priority 10 · in1-smtp.messagingengine.comThese should be the only two MX records for your domain. |
| Receiving mail | MX | {domain} | priority 20 · in2-smtp.messagingengine.com |
| SPF | TXT | {domain} | v=spf1 include:spf.messagingengine.com ?allFastmail's record ends in ?all, which is neutral; merge other senders into this one record. |
| DKIM | CNAME | fm1._domainkey.{domain} | fm1.{domain}.dkim.fmhosted.comYour full domain, with dots rather than dashes, goes inside the target. |
| DKIM | CNAME | fm2._domainkey.{domain} | fm2.{domain}.dkim.fmhosted.com |
| DKIM | CNAME | fm3._domainkey.{domain} | fm3.{domain}.dkim.fmhosted.comFastmail needs all three CNAMEs. |
| DMARC optional | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address}Fastmail says your domain works without a DMARC policy. |
SPF
Add include:spf.messagingengine.com to the SPF record at your root domain; Fastmail's documented record is v=spf1 include:spf.messagingengine.com ?all. It authorizes Fastmail's servers for your domain, but with ?all (neutral) the DKIM CNAMEs are what Fastmail relies on for authentication.
DKIM
Three CNAMEs, fm1, fm2 and fm3 under _domainkey, point to fm1.{domain}.dkim.fmhosted.com and so on. Fastmail hosts the keys behind them, so it can change keys without DNS edits. A subdomain you send from needs its own three CNAMEs.
DMARC alignment
DKIM aligns once the three fm CNAMEs are published, because Fastmail then signs with your domain. The SPF record ends in ?all, so treat DKIM as the identifier that carries DMARC.
Common mistakes
- Add all three DKIM CNAMEs (fm1, fm2 and fm3), not just one.
- Fastmail's SPF record ends in ?all (neutral), not ~all or -all.
- Only one TXT record may start with v=spf1, so merge other senders into it.
- A subdomain you send from needs its own SPF record and its own fm1, fm2 and fm3 CNAMEs.
- A mesmtp._domainkey CNAME is the deprecated selector of domains hosted at Fastmail before 2018; the fm1, fm2 and fm3 CNAMEs replace it.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed:
How EmailSecOps recognises Fastmail
A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:
- SPF include, current or legacy: spf.messagingengine.com
- Default DKIM selectors: fm1, fm2, fm3
- DKIM keys delegated (CNAME) to *.fmhosted.com