Set up DNS for your domain
Each domain's page lists the records it needs, with their values and a Copy button (also GET /v1/tenants/{id}/domains/{domain}/dns). DKIM keys are explained in Sending mail to other servers, and DKIM; SPF and DMARC values follow the domain's settings (see SPF, DKIM and DMARC). For step-by-step help at your provider, see DNS guides for common providers.
Records Zappocity needs
| Record | Name | Value |
|---|---|---|
| MX | your domain | the Mailocity mail host from your DNS checklist |
| TXT (SPF) | your domain | the SPF value from your DNS checklist |
| TXT (DKIM) | <selector>._domainkey | the DKIM key from your DNS checklist |
| TXT (DMARC) | _dmarc | the DMARC policy from your DNS checklist |
| CNAME | mta-sts. | the Mailocity mail host, for MTA-STS |
| TXT (MTA-STS) | _mta-sts | v=STSv1; id=... from your DNS checklist |
| CNAME | autoconfig., autodiscover. | the mail host, so mail apps set themselves up (optional) |
| CNAME | openpgpkey. | the mail host, for published OpenPGP keys (optional) |
| TXT | _zappocity-verify | the ownership record (see below) |
Check your records
On the domain's page, Check DNS looks up every record and shows, next to each, whether DNS has it right, missing, different (with what was found), or worth a check (for example other mail servers in the MX list too). Two SPF or two DMARC records count as wrong, because receivers then ignore both. Records marked optional (app discovery, DKIM keys not signing yet, the ownership record once proved) help but mail works without them. DNS changes can take a while to show; check again later. From the command line: corpsuite domain dns check TEAM DOMAIN.
While a new domain is being set up
Until every required record is right, the domain's page checks on its own every 30 seconds while it is open, with a progress bar showing how many required records are in place. Zappocity also checks a team's new domain in the background, every 30 minutes for its first week, so you can close the page. The first time everything is right, each of the team's owners gets an email, "<domain> is set up"; it is sent only once. The domain's dnsCheckedAt, dnsOkAt and dnsProblems (in the API and corpsuite domain show) say when it was last checked, when it was first all right, and how many required records were missing or different.
The ownership record
The list starts with _zappocity-verify.<domain> (TXT): the record that proves the domain is the team's. A domain added without proof shows it with Verify at the top of the page: publish it, then choose Verify (corpsuite domain verify TEAM DOMAIN). For a proved domain it is listed as optional: keep it, so the proof can be checked again.
Import every record at once with a zone file
Instead of adding the records one by one, you can download them all as a zone file and import it at your DNS provider. In the admin panel, open the domain and click Download zone file above the record list. You get <your domain>.zone, a standard (BIND) zone file holding every record from the list, long DKIM values already split, each with a comment saying what it is for. It has no SOA or NS records, so it does not touch who hosts your DNS.
| Provider | How to import |
|---|---|
| Cloudflare | DNS > Records > Import and Export, then upload the file. |
| AWS Route53 | Open the hosted zone, choose Import zone file, and paste the file's contents. |
| Google Cloud DNS | gcloud dns record-sets import <your domain>.zone --zone=<zone name> --zone-file-format |
| Others | Look for Import zone file or Import records in the DNS settings. If there is none, add the records by hand from the list. |
Before importing, remove any MX, SPF (v=spf1) or DMARC records your provider already has for the domain: a domain must have only one SPF and one DMARC record, and old MX records would send some mail elsewhere. Some providers refuse an import that clashes with an existing record; others add the new one next to it.
The file comes from the API too: GET .../dns?format=zone on /v1/tenants/{tenantId}/domains/{domain}/dns and /v1/shared-domains/{domain}/dns.
Long TXT records (DKIM)
One string in a DNS TXT record can hold at most 255 characters. A 2048-bit RSA DKIM record is about 410, so it has to be published as two or more strings. Receivers join the strings back together with nothing between them, so it does not matter where the cut falls.
Your DNS checklist shows every TXT record already split, like this:
"v=DKIM1; k=rsa; p=MIIBIjANBgkq...first 255 characters" "...the rest"Paste that whole line, quotes included, with the Copy button. Under a DKIM record there is also Copy single line, the value without quotes or splitting, for providers that ask for the plain value and split it themselves.
| Provider | What to paste |
|---|---|
| AWS Route53 | Copy (the quoted strings). Route53 rejects one unquoted string over 255 characters. |
| BIND or another zone file | Copy, after IN TXT. |
| Cloudflare | Either. Cloudflare splits a single line itself. |
| GoDaddy, Namecheap, Porkbun, Squarespace | Copy single line if the quoted form is refused or the quotes show up in the record. |
To check what is published, run dig +short TXT <selector>._domainkey.<your domain>. It should print the quoted strings, and joined they should equal the single-line value. If you see the quotes inside the strings ("\"v=DKIM1), the provider kept them: paste the single line instead.
The API gives both forms: value and zoneValue on each TXT record from GET .../dns, and dnsValue and dnsZoneValue on each key from GET .../dkim.
Automatic updates with AWS Route53
With your domain's DNS in Route53, Zappocity can publish these records for you, and keep them right, with an AWS key limited to your hosted zone: see Automatic DNS for the IAM policy and the steps.
Provider guides
See DNS guides for common providers: AWS Route53, Cloudflare, GoDaddy, Namecheap, Squarespace, Porkbun, OVHcloud, Hetzner and DigitalOcean.