# Connect your domain to Business Email: MX, SPF, DKIM, DMARC and automatic setup records

https://www.gyrohosting.com/en/knowledgebase/article/business-email-domain-dns-records

- **What you will learn**: How to verify domain ownership, add the DNS records Business Email needs at your DNS provider, check them live in the client area, switch over without interrupting your current email, and fix the most common DNS mistakes.
- **Time**: 15 minutes (plus a few minutes to a few hours for DNS to propagate)

## 1. Why do I need DNS records?

Email runs on your domain's DNS records. Without them, the internet does not know where to deliver mail for `@examplecompany.com`, and the mail you send looks "unauthenticated" to receiving servers and may land in spam.

The client area prepares the **expected** value of every record for you; you only copy and paste it into your DNS provider. You do **not** need to change your name servers (NS); your website and other records stay as they are.

| Record | Type | Required | What it does |
| --- | --- | --- | --- |
| **Ownership verification** | TXT (`_gyromail`) | Until verified | Proves the domain is yours. Not needed if MX already points to us. |
| **MX (incoming)** | MX, priority 10 | Yes | Delivers mail for your domain to our mail server. |
| **SPF** | TXT (`@`) | Yes | Declares which servers may send mail for your domain. Recommended value `v=spf1 mx include:_spf.gyrohosting.com ~all`. |
| **DKIM signature** | TXT (`default._domainkey`) | Yes | Signs every outgoing message on behalf of your domain, so the receiver can check it was not altered. |
| **DMARC** | TXT (`_dmarc`) | Yes | Tells receivers what to do with mail that fails SPF and DKIM. Start with `p=none` (monitor only). |
| **Autoconfig** | CNAME (`autoconfig`) | Recommended | Thunderbird, K-9 Mail / FairEmail and Evolution find the server settings themselves. |
| **Outlook autodiscover** | CNAME (`autodiscover`) | Recommended | Outlook sets the account up with just the address and password. |
| **Outlook autodiscover (SRV)** | SRV (`_autodiscover._tcp`, 0 1 443) | Recommended | An extra autodiscover path for Outlook. |
| **IMAP autodiscovery (SRV)** | SRV (`_imaps._tcp`, 0 1 993) | Recommended | Apps that support this standard find the incoming server. |
| **SMTP autodiscovery (SRV 465)** | SRV (`_submissions._tcp`, 0 1 465) | Recommended | The same apps find the outgoing server. |
| **SMTP autodiscovery (SRV 587)** | SRV (`_submission._tcp`, 0 1 587) | Recommended | The port 587 path for the outgoing server. |
| **imap. server name** | CNAME (`imap`) | Recommended | The incoming server name Android Gmail and Samsung / Xiaomi mail apps guess. |
| **smtp. server name** | CNAME (`smtp`) | Recommended | The outgoing server name the same apps guess. |
| **mail. server name** | CNAME (`mail`) | Recommended | A common server name some apps try. |

All recommended records point to `mx1.gyrohosting.com`. In the client area they are grouped under **Automatic setup (email + password only)**. Mail still works without them; you just have to type the server name by hand when you set up a device.

### The `imap.`, `smtp.` and `mail.` names and the security certificate

When these three names (and `autoconfig`, `autodiscover`) point to `mx1.gyrohosting.com`, our mail server adds them to its security certificate automatically. This happens at the next daily certificate renewal at the latest: within 24 hours of adding the record, usually overnight. Once that is done, `imap.examplecompany.com` (993) and `smtp.examplecompany.com` (465 or 587) work without warnings. Until then, if an app shows a certificate warning, use `mx1.gyrohosting.com` as the server name; it always works.

## 2. Before you start: the switch-over order

If your domain has working email somewhere else right now, **change the MX record last**. As soon as MX changes, new mail starts arriving with us, so your mailboxes must be ready and your old mail moved before that.

Recommended order:

1. Add the **ownership verification** TXT record and click **Verify** (this does not affect your current email).
2. Add the **SPF, DKIM and DMARC** records. Merge SPF with your existing record (Section 4).
3. Create your mailboxes in the client area.
4. Move your old mail with **IMAP Migration** in the client area.
5. Finally change the **MX** record, delete the old MX records and add the **automatic setup** records.

> **Warning**
> 
> Do not add the automatic setup records (especially `imap`, `smtp`, `mail` and `autodiscover`) before MX. While your mail is still with the old provider, they would send phones and Outlook to the new server and users would see an empty mailbox. If a name such as `mail.examplecompany.com` points to your old mail server, change it together with MX.

> **Warning**
> 
> Until domain ownership is verified, the domain stays inactive on our server: incoming mail is not accepted, mailboxes cannot log in and webmail does not open. The domain is enabled automatically once verified.

If this is a new domain that has never had email, you can add all records at once; verification completes automatically when MX points to us.

## 3. Step by step DNS setup

1. In the client area, open **My Services** and click your Business Email service.
2. Click the **DNS Setup** card on the service page (or under **Setup** › **DNS Setup**).
3. If the domain is not verified yet, a **Verify domain ownership** box appears at the top. Copy the **Name (Host)** (`_gyromail`) and **Value** lines.
4. At your DNS provider, create a **TXT** record with this information and save it.
5. Back in the client area, click **Verify**. You will see "Domain verified." If the record is not visible yet, try again in a few minutes.
6. For every row in the table, add a record with the same **Type**, **Name (Host)** and expected value at your DNS provider. The copy icon next to the value copies the full value (long values are shortened on screen).
7. Set the MX priority to **10**.
8. Save at your DNS provider and click **Check now** in the client area.
9. Look at the status column: **Correct**, **Wrong**, **Missing** or **Unreadable**. When all required records are correct, the top of the page says "All required records are correct. Your email service is live."

The check runs live from our mail server and asks your domain's own name server first, so a record you just added usually shows up right away. You can use **Check now** at most once every 20 seconds. The system also checks your records every hour; if required records are still missing, you get reminder emails on day 1, 3 and 7 of the service.

### If your domain's DNS is hosted by us: records are added for you

If we manage your domain's DNS, you do not need to add the records yourself:

| Where your DNS is | What happens |
| --- | --- |
| Your **Gyro DNS** service | The records are added as soon as the Business Email service is activated. |
| The Cloudflare account we manage for your domain | The records are added when the service is activated. |
| A Gyro shared hosting (cPanel) server | If MX already points to Business Email, the automatic setup records are added by the hourly check, within 1 hour. |

The system also looks for missing records once a day. If your DNS is in Gyro DNS or in the Cloudflare account we manage, an **Add records automatically** button appears next to **Check now** and adds whatever is missing in one click.

Automatic adding follows two rules:

- It **never overwrites** an existing record with a different value. If another record already uses the name (for example `mail` points to your website or old mail server), that row is left as it is and the client area tells you which records were not changed.
- When records are added on their own, the automatic setup records are written only once MX points to us. While your mail is still elsewhere, phones are not sent to the wrong server.

If your DNS is with another provider (your registrar, your own Cloudflare account and so on), the client area says so and you add the rows from the table yourself.

## 4. Things to watch when adding records

- **Name (Host) field:** type the short name from the table (`@`, `_dmarc`, `default._domainkey`). Most panels add the domain to the end themselves; if you type the full name, the record ends up at a wrong name such as `default._domainkey.examplecompany.com.examplecompany.com`.
- **Cloudflare:** turn off the orange cloud (**DNS only**) on all CNAME records (`autoconfig`, `autodiscover`, `imap`, `smtp`, `mail`). Mail records do not work through the proxy.
- **SRV records:** if your panel has separate fields, enter priority **0**, weight **1**, the port (**443**, **993**, **465** or **587**) and target `mx1.gyrohosting.com`. Type the short name such as `_imaps._tcp` in the name field.
- **TXT values:** paste them without quotes. The DKIM value is long; some panels split values longer than 255 characters on their own, which is normal.
- **Old MX records:** delete all old MX records. Only our MX record should remain; otherwise some mail goes to the old server.

### Merging SPF

A domain can have **only one SPF record**. If you already have a TXT record starting with `v=spf1`, do not create a second one; add `include:_spf.gyrohosting.com` to the existing record.

Example: if your website sends form email from a server at `203.0.113.10`:

```
v=spf1 mx ip4:203.0.113.10 include:_spf.gyrohosting.com ~all
```

Remove your old provider's `include:` value after the migration is finished and MX has changed.

### Tightening DMARC over time

The client area suggests DMARC with `p=none`: no mail is rejected, it is only monitored. After a few weeks, once you are sure every service that sends mail for you passes SPF and DKIM, you can move to `p=quarantine` and then `p=reject`. There is no need to rush this.

## 5. Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| **Verify** says the verification record is not visible yet | The record is new or was added at the wrong name | Make sure the name is `_gyromail` and the value is complete and without quotes; try again in a few minutes. |
| "There are other MX records too" note on the MX row | The old provider's MX records are still there | Delete the old MX records. |
| "More than one SPF record" on the SPF row | Two separate `v=spf1` records | Merge them into one (Section 4). |
| A record shows **Wrong** | The value was copied incompletely or the name contains the domain twice | Copy the full value again with the copy icon; type only the short name. |
| A record shows **Unreadable** | The DNS query got no answer at that moment | **Check now** again in a few minutes. If it continues, check that your name servers are working. |
| "These records exist with different values and were not changed", or the `imap`, `smtp`, `mail` row cannot be added | Another record already uses the name (for example `mail` points to your website or old mail server) | If the name is no longer used, delete the old record and add the CNAME. If it is still used, leave it; use `mx1.gyrohosting.com` as the server name on devices. |
| Automatic setup records are in place but `imap.examplecompany.com` shows a certificate warning | The name has not been added to the certificate yet | It fixes itself within 24 hours; use `mx1.gyrohosting.com` meanwhile. |
| Records are correct but mail still goes to the old server | The old MX cache time (TTL) has not expired | Wait up to a few hours; keep syncing the old mailbox with IMAP Migration meanwhile. |

## 6. How long does it take?

A DNS change can take from a few minutes to a few hours to be visible everywhere. This depends on the record's old cache time (TTL) and cannot be sped up on our side. Our check asks your domain's name server directly, so you usually see "Correct" before the rest of the internet sees the new MX.

## 7. Frequently asked questions

**Do I need to point my name servers (NS) to Gyro?**

No. For Business Email you only add the records in the table at your current DNS provider. Changing name servers means moving your website and all other records too; do not do it unless you need to.

**Will my email stop when I change the MX record?**

Not if you follow the order. Create the mailboxes and move the old mail first, and change MX last. Some mail may keep going to the old server for a few hours; if you run IMAP Migration again, it is copied to your new mailbox too.

**Can I skip the recommended records?**

Yes; you can still send and receive mail. Outlook, Thunderbird and phones just cannot find the server settings themselves, so you type the server name by hand.

**What do the automatic setup records do?**

When your users add their account, they type only their email address and password; the app finds the server name, port and security type from these records. Device steps: [Webmail and device setup](https://www.gyrohosting.com/en/knowledgebase/article/business-email-webmail-and-device-setup).

**Can I use mail.examplecompany.com as the server name?**

Yes, once the `mail`, `imap` and `smtp` CNAME records are in place and the certificate is ready (within 24 hours of adding the record). Otherwise use `mx1.gyrohosting.com`; it always works.

**Can I set DMARC to p=reject right away?**

You can, but we do not recommend it. If another system that sends mail for you (website, invoicing software) does not pass SPF/DKIM, its mail is rejected. Start with `p=none`.

## Next step

- **Records done?** Set up webmail and your devices: [Webmail and device setup](https://www.gyrohosting.com/en/knowledgebase/article/business-email-webmail-and-device-setup)
- No Business Email service yet? See [Business Email plans](https://www.gyrohosting.com/en/corporate-mail).