# How do you set up email on a new business domain? URL: https://iblockspam.com/blog/new-domain-email-setup-checklist Last updated: 2026-10-09 Published: 2026-10-09 Topic: Setup guides Author: iBlockSpam Team > Setting up email on a new business domain? Follow this checklist: MX, SPF, DKIM, DMARC from p=none to enforcement, optional MTA-STS and BIMI, PTR and warm-up. ## Short answer Create your mailboxes, then publish MX records pointing to your mail provider, one SPF record listing every sender, DKIM keys for each sending service, and a DMARC record starting at p=none with reports. Move DMARC to quarantine and reject once reports are clean. Add MTA-STS, TLS-RPT and BIMI later if useful, and warm up sending volume slowly. A new domain is a clean slate. Nothing is configured and it has no sending history. Until you publish SPF, DKIM and DMARC, receivers have no reliable way to tell your real mail from a forgery. Setting up email properly from day one is far easier than untangling a half-configured domain later. This checklist covers every DNS record a business domain needs for email, in the order to add them, with optional extras at the end. If the terms are new to you, skim [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc) first. ## What is the full checklist? | # | Item | Required? | Record | |---|---|---|---| | 1 | Choose a mail provider and create mailboxes | Yes | None | | 2 | Find where your DNS is hosted | Yes | None | | 3 | MX records | Yes | MX at `@` | | 4 | SPF | Yes | TXT at `@` | | 5 | DKIM | Yes | TXT or CNAME at `._domainkey` | | 6 | DMARC at `p=none` | Yes | TXT at `_dmarc` | | 7 | Reverse DNS (PTR) | Only if self-hosting | PTR, set by the IP owner | | 8 | Test everything | Yes | None | | 9 | Move DMARC to enforcement | Yes, after reports | Edit `_dmarc` | | 10 | MTA-STS and TLS-RPT | Optional | TXT plus a policy file | | 11 | BIMI | Optional | TXT at `default._bimi` | | 12 | Warm up sending volume | If you send bulk mail | None | The rest of this guide takes each step in turn. ## Step 1 and 2: Where do you start? Pick your mailbox provider (Microsoft 365, Google Workspace or another) and add the domain there first. The provider gives you the exact MX, SPF and DKIM values for your tenant, and usually asks you to prove ownership with a TXT record. Then find where your DNS is hosted. It's often your registrar, but not always. Our [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows the live nameservers. We have step-by-step guides for adding records at [Cloudflare](https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare), [GoDaddy](https://iblockspam.com/blog/add-email-dns-records-godaddy) and [Namecheap](https://iblockspam.com/blog/add-email-dns-records-namecheap). ## Step 3: How do you set up MX records? MX records tell the world where to deliver your mail. Add exactly what your provider specifies. Google Workspace, for example, now uses a single MX record, `smtp.google.com` with priority 1, and says it can take up to 72 hours for new MX records to start working ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace)). - Remove any default MX records your registrar added, such as ones pointing to its own mail or forwarding service, unless your provider says to keep them. - Point MX at a hostname, never an IP address. - If you plan to filter inbound mail through a gateway, your MX will point to the filtering service instead, which then delivers to your mailboxes. Our guide to [what an MX record is](https://iblockspam.com/blog/what-is-an-mx-record) explains priorities and backup MX. ## Step 4: How do you set up SPF? SPF lists the servers allowed to send mail as your domain. Publish **one** TXT record at your bare domain. [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2) says a domain "MUST NOT have multiple records" that an SPF check would select. Start with your mailbox provider's include, then add every other service that sends as your domain: website forms, invoicing, CRM, newsletters, help desk. A typical new Microsoft 365 domain starts with: ``` v=spf1 include:spf.protection.outlook.com -all ``` Microsoft documents this value for domains on Microsoft 365 ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure)). Our [SPF provider pages](https://iblockspam.com/spf) list the include for each common service, and the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) merges them and counts DNS lookups, which must stay at 10 or fewer. See [SPF softfail vs hardfail](https://iblockspam.com/blog/spf-softfail-vs-hardfail) to choose between `~all` and `-all`. ## Step 5: How do you set up DKIM? DKIM signs each message so receivers can check it came from your domain unaltered. Each service that sends for you needs its own DKIM key on your domain: - **Microsoft 365:** publish two CNAME records (`selector1._domainkey` and `selector2._domainkey`), then turn on signing in the Defender portal ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure)). - **Google Workspace:** generate a key in the Admin console, publish it as a TXT record at `google._domainkey`, then select **Start authentication**. Choose a 2048-bit key if your DNS host supports it. - **Other senders:** each has its own selector and record. Our [DKIM records by provider](https://iblockspam.com/dkim) pages list them. Our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) has the full steps. Check each key with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker). ## Step 6: How do you start DMARC on a new domain? DMARC ties SPF and DKIM to the address people see in the From line, tells receivers what to do with failures, and sends you reports. Google recommends you "Set up DKIM and SPF at least 48 hours before setting up DMARC," then start with a policy of `none` for about a week while you read the daily reports ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/recommended-dmarc-rollout)). A first record, published as TXT at `_dmarc`: ``` v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com ``` Use a reporting mailbox you will actually read, or a report service. The [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record, and [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) explains every tag. ## Step 7: Do you need reverse DNS? Only if you run your own mail server. Google requires that "sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records" ([Gmail Help](https://support.google.com/mail/answer/81126)). Hosted providers manage this for their own IPs. For a self-hosted server, ask whoever owns the IP address, usually your hosting company, to set a PTR record whose hostname resolves back to that IP. Check it with our [PTR Lookup](https://iblockspam.com/tools/ptr-lookup), and see [reverse DNS for mail servers](https://iblockspam.com/blog/reverse-dns-ptr-records-for-mail-servers). ## Step 8: How do you test the setup? 1. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) for an overview of MX, SPF, DKIM and DMARC. 2. Send a message from each sending service through our [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test) and confirm SPF, DKIM and DMARC pass. 3. Send mail in from an outside account to confirm delivery works. 4. Add your domain to [Google Postmaster Tools](https://iblockspam.com/blog/google-postmaster-tools-guide) so you can see Gmail's view as you start sending. ## Step 9: When should DMARC move to enforcement? Once your reports show every legitimate sender passing. Google's rollout moves from `none` to `quarantine` for a growing share of messages, then to `reject`, reviewing reports daily, and warns that with reject, failing messages "are rejected by receiving servers and never delivered" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/recommended-dmarc-rollout)). A new domain has an advantage here: there are no forgotten legacy senders. Many established sites never get this far. In our [scan of the top 1,000 websites](https://iblockspam.com/research/email-security-top-1000), 38.3% of domains don't enforce DMARC. Our [none-to-reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers each stage, including how DMARC test mode replaced percentage rollouts in the current standard. ## Step 10: Should you add MTA-STS and TLS-RPT? They're optional, and worth doing once the basics are stable. MTA-STS ([RFC 8461](https://www.rfc-editor.org/rfc/rfc8461.html)) tells sending servers to deliver to your MX hosts only over TLS with valid certificates. It needs a TXT record at `_mta-sts` and a policy file served over HTTPS at `mta-sts.yourdomain`. TLS-RPT adds a TXT record at `_smtp._tls` so senders report TLS failures to you. Start the policy in `testing` mode, read the reports, then switch to `enforce`. Our [MTA-STS and TLS-RPT guide](https://iblockspam.com/blog/mta-sts-tls-rpt-explained) has the record formats, and the [MTA-STS Checker](https://iblockspam.com/tools/mta-sts-checker) validates them. ## Step 11: Is BIMI worth it for a new domain? BIMI shows your logo next to your mail in supporting inboxes. Google's requirements are strict: a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC), and a DMARC policy of `quarantine` or `reject`, because "BIMI doesn't support DMARC policies that have the p option set to none" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-bimi)). Google notes that getting a logo trademarked for a VMC can take 6 to 12 months. For most new domains, BIMI is a later project. See [BIMI explained](https://iblockspam.com/blog/bimi-explained-brand-logo-in-inbox). ## Step 12: How do you warm up a new domain? A new domain has no reputation, good or bad. Google's guidance is to "Start with a low sending volume to engaged users, and slowly increase the volume over time," to avoid "sudden volume spikes," and to monitor delivery with Postmaster Tools as you grow ([Gmail Help](https://support.google.com/mail/answer/81126)). Everyday one-to-one business mail needs no special plan. Newsletters and bulk sends do; see our [warm-up guide](https://iblockspam.com/blog/email-warm-up-new-domain-ip). ## What about domains you don't use for email? If you registered extra domains, such as misspellings or other country endings, that will never send mail, lock them down too. Publish an SPF record of `v=spf1 -all` and a DMARC record with `p=reject`. Our guide to [protecting parked domains](https://iblockspam.com/blog/protect-parked-domains-from-spoofing) has the full set of records. ## Next steps 1. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) on your new domain now, and again after each step. 2. Build your records with the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) and [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator). 3. Confirm each DKIM key with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker). 4. Put a reminder in your calendar to review DMARC reports and move toward enforcement. If you want inbound spam and phishing filtered before it reaches your new mailboxes, a domain-level filter such as iBlockSpam is added with an MX change; see [how it works](https://iblockspam.com/how-it-works). More guides are in [setup guides](https://iblockspam.com/blog/topic/setup). Once everything is published, the [Free Domain Watch](https://iblockspam.com/free-monitoring) can keep an eye on it: weekly checks of your public MX, SPF, DMARC and MTA-STS records, with an email when anything changes. ## Frequently asked questions ### In what order should I set up MX, SPF, DKIM and DMARC on a new domain? Create mailboxes first, then MX so mail arrives, then SPF and DKIM so your outgoing mail authenticates, then DMARC. Google recommends setting up DKIM and SPF at least 48 hours before DMARC. MTA-STS, TLS-RPT and BIMI come last, once the basics are stable and your DMARC reports look clean. ### Do I need a DMARC record if my new domain sends very little email? Yes. DMARC protects your domain from being spoofed, which has nothing to do with how much you send. Google also requires DMARC from bulk senders. Start with p=none and a reporting address, then move to quarantine and reject once you know every legitimate sender passes SPF or DKIM aligned with your domain. ### Should a new domain start with SPF ~all or -all? Either works for DMARC, which only cares whether SPF passes. Use ~all (softfail) while you're still discovering senders, so a missed service gets flagged rather than rejected by strict receivers. Microsoft recommends -all for Microsoft 365 domains that also use DKIM and DMARC, once you're sure the record is complete. Review it after your first DMARC reports. ### Do I need a PTR record for my new domain? Only if you run your own mail server. Google requires sending IPs to have valid forward and reverse DNS. If you use Microsoft 365, Google Workspace or another hosted provider, they manage reverse DNS for their sending IPs. Self-hosted servers need a PTR set by whoever owns the IP, usually the hosting company. ### How soon can a new domain send bulk email? Not straight away. Google tells senders to increase sending volume slowly, start with engaged recipients, avoid sudden spikes and watch Postmaster Tools as volume grows. A new domain has no sending history, so send normal business mail first and build bulk volume gradually over weeks. ## Sources - [Google Workspace Admin Help: Set up MX records for Google Workspace](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace) - [Google Workspace Admin Help: Recommended DMARC rollout](https://knowledge.workspace.google.com/admin/security/recommended-dmarc-rollout) - [Gmail Help: Email sender guidelines](https://support.google.com/mail/answer/81126) - [Microsoft Learn: Set up SPF to identify valid email sources for your Microsoft 365 domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure) - [Microsoft Learn: How to use DKIM for email in your custom domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure) - [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html) - [RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)](https://www.rfc-editor.org/rfc/rfc8461.html) - [Google Workspace Admin Help: Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi) ## Free tools for this guide - [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan. - [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts. - [SPF Record Generator](https://iblockspam.com/tools/spf-generator): Build a valid SPF record from your mail providers, with a DNS lookup count. - [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings. --- Source: iBlockSpam, https://iblockspam.com/blog/new-domain-email-setup-checklist (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt