DNS helpers: MX, SPF, DMARC, CAA and SRV

Some records are tricky to type by hand. That's why the DNS record window has extra fields and buttons for a few types. You open the window on the DNS tab with + Add record (see Managing DNS: adding, editing and deleting records) and then choose the type.

MX record

Click + MX record, or choose the type MX. The name is already set to @, the domain itself.

• Priority (1): with multiple MX records, the lowest is tried first. 10 is a common value.
• Mail server (2): the name of the mail server, with a full stop at the end.

Please note: incorrect MX records mean email will stop arriving. Always copy the values from your mail provider.

SPF: who may send email on behalf of your domain?

SPF is a TXT record with a list of servers that may send email on behalf of your domain. Choose the type TXT and set TXT record type (1) to SPF. If you already have an SPF record, click Manage next to SPF in the Email settings card. The window will then read in your existing record.

1. The checkboxes (2) let you authorise the servers from your MX records and the IP address of your domain.
2. Under Add provider (3), click your mail provider or sending service: WebOké, Microsoft 365, Google Workspace, Proton Mail, mailbox.org, Mailgun, SendGrid or Zendesk. If yours isn't listed, type an include domain or a server hostname yourself and click the plus.
3. Choose the Mode (4): what recipients should do with email from a server that isn't on the list. SoftFail (recommended) marks the mail as suspicious; start with this, and it's the default. Fail (strict, once everything is correct) has the mail rejected: only choose this once you're certain that every service sending on behalf of your domain is on the list. Neutral does nothing.
4. Under Advanced Features you'll find separate IP addresses and a few rarely used options.
5. Under Value (5) you see the record that will be saved. You can also edit it directly here.

Please note: a domain may only have one SPF record. If there are two, SPF becomes invalid. So edit the existing record instead of creating a second one.

DMARC: what happens to spoofed email?

DMARC tells mail servers what to do with email that falsely claims to come from your domain. Choose the type TXT and set TXT record type to DMARC, or click Manage next to DMARC in the Email settings card. The name automatically becomes _dmarc.

• Domain policy type (1): None (only reporting), Quarantine (to spam) or Decline.
• Aggregate email (RUA) (2): the address where you receive daily reports from large mail providers.
• Advanced Features (3): includes a separate policy for subdomains, an address for forensic reports (RUF), a percentage and the strictness of the check. Leave the percentage at 100: in the new DMARC standard (RFC 9989, 2026), this field will disappear.
• Value (4): the record as it will be saved.

Tip: start with None (only reporting) and a report address. Check the reports for a few weeks, then set the policy to Quarantine (to spam) and after that to Decline. This way you avoid your own email being blocked. With a hosting package, the record is set to Decline by default; you can leave it that way if all your email goes through WebOké.

CAA record

With a CAA record you decide which parties may issue an SSL certificate for your domain. Choose the type CAA and fill in:

• Flag: leave this at 0.
• Tag: issue for regular certificates, issuewild for wildcard certificates, or iodef for a notification address.
• Value: the issuer, for example letsencrypt.org.

Please note: once you set a CAA record, only the listed issuers may issue certificates. If you use the free SSL certificate from your hosting package (Let's Encrypt), make sure to include letsencrypt.org in a CAA record.

SRV record

An SRV record points a service to the right server and port. You need it, for example, for internet calling or for some Microsoft services. Choose the type SRV.

• Name: usually in the form _service._protocol, for example _sip._tls.
• Priority and Weight: which server is used first if there are several. Leave these as they are unless your provider says otherwise.
• Port: the port of the service.
• Destination: the server, with a full stop at the end.

For each type, click Save record once everything is correct, or Cancel to leave things unchanged.