Zarfio DNS setup: MX, SPF, DKIM and DMARC

Steps

1. Open an account and add the domain. Create a Zarfio account and add the domain you own. The panel lists the records that domain needs.
2. Verify the domain. Publish the verification record the panel shows at your DNS host, then confirm it in the panel.
3. Create the mailboxes. Create every address you use today before moving MX. Existing mailboxes at Google Workspace or Yandex 360 can be migrated.
4. Lower the MX TTL and switch MX. On a domain that already receives mail, lower the MX TTL first. Then replace the old MX records with the ones from the panel.
5. Publish SPF, DKIM and DMARC. Copy the SPF and DKIM values from the panel exactly as shown. If another service also sends for the domain, keep one SPF record and add that service’s include: to it.
6. Check with OrbitProbe. Run the MX, SPF, DKIM and DMARC checks on this page until each one reads the values from the panel.

DMARC

DMARC is the same for every provider: one TXT record at _dmarc.example.com. Start with p=none and a reporting address, so you receive reports without affecting delivery.

Read the reports for a few weeks. When every legitimate sender passes SPF or DKIM with an aligned domain, move to p=quarantine and then p=reject. Moving to reject before DKIM is on for all senders is the usual way legitimate mail gets lost.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Optional: MTA-STS, TLS-RPT and BIMI

MTA-STS tells sending servers to require TLS when delivering to you. It needs a TXT record and a policy file served over HTTPS at mta-sts.example.com; the policy must list the MX hosts of your provider exactly.

TLS-RPT asks senders to report TLS delivery failures to an address you choose. One TXT record, no effect on delivery.

BIMI lets some mailbox providers show your logo. It requires DMARC at quarantine or reject, and most providers also require a verified mark certificate.

_mta-sts.example.com.  3600  IN  TXT  "v=STSv1; id=20260921T000000"
_smtp._tls.example.com.  3600  IN  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"
default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/logo.svg"

Mail clients: autodiscover and autoconfig

Zarfio mailboxes work with webmail and with standard IMAP, SMTP and ActiveSync clients. For manual setup use the server names shown in the Zarfio panel.

TTL advice

Before changing MX records on a domain that already receives mail, lower their TTL to 300 seconds and wait for the old TTL to run out. Resolvers then pick up the new records within minutes.

When the new setup has worked for a few days, raise the TTL again: 3600 seconds is a common value. SPF, DKIM and DMARC records change rarely and are fine at 3600.

How long do the changes take?

Your authoritative nameservers answer with the new record as soon as your DNS host has published it. A resolver that cached the old answer keeps it until the old TTL runs out; a name that did not exist before may be remembered as missing for the negative-caching time in your SOA record.

There is no moment at which a change is everywhere at once. The propagation tool shows what a fixed set of public resolvers answer at the time of the check, reported as a count such as "9 of 12 resolvers", and nothing more than that.

Providers re-check your records on their own schedule, so a verification button in the panel can stay red for a while after DNS is already correct.

Common mistakes

• Switching MX before the mailboxes exist, so mail for addresses that were not created yet is rejected.
• Two SPF records. A domain may have only one TXT record that starts with v=spf1; a second one makes SPF fail with a permanent error. Merge the include: mechanisms into one record.
• Leaving the old provider’s MX records next to the new ones. Mail is then delivered to either, depending on priority and chance.
• Typing the full name into a host field that appends the domain, which produces google._domainkey.example.com.example.com. Look the record up after saving it.
• A DKIM key cut in half. Long TXT values must be split into quoted strings of at most 255 characters; most DNS hosts do this for you, some do not.
• More than ten DNS lookups in SPF after adding several include: mechanisms. The SPF checker counts them.
• An MX record that points to a CNAME or to an IP address. It must point to a hostname that has A or AAAA records.