Which DNS records we add, and why

Four record types get written, and each does a different job. MX says which servers accept mail for the domain — without it, nothing arrives. SPF lists which servers may send as you, so a receiver can reject anything else claiming to be you.

DKIM adds a cryptographic signature to outbound mail, which proves the message was not altered between us and the recipient. DMARC ties SPF and DKIM together and tells receivers what to do when a message fails both — and, importantly, asks them to report it, which is what makes spoofing of your domain visible rather than silent.

You can inspect all four from the domain's page at any time. If you would rather manage them yourself, they are plain records with no proprietary format and nothing stopping you editing them.