DNS
Fastmail DNS record generator
Get every DNS record a Fastmail custom domain needs - MX, SPF and all three DKIM CNAMEs - with nothing left as a placeholder.
Free, no accountIn your browser
The MX and SPF records below do not need this. The three DKIM CNAMEs do - each one is built from this domain.
Result
MX and SPF ready - add a domain for DKIM
Type your domain above to add the three DKIM CNAME records to the set below.
- Info
Type your domain to get the three DKIM CNAME records
Fastmail's DKIM targets embed the domain itself, so there is no fixed value to show until one is typed - the MX and SPF records below are unaffected and already correct.
- Passed
MX and SPF are fixed for every Fastmail custom domain
Both mail servers and the SPF include are the same for every account Fastmail hosts, so these two records need no domain-specific substitution at all.
MX records to publish
At @ (MX)
Priority then host. Both go at the root of the domain, not a subdomain.
SPF record to publish
At @ (TXT)
Publish this at the domain itself. A domain may only have one SPF record.
DNS records for your domain
| Host | Type | Value | Priority |
|---|---|---|---|
| @ | MX | in1-smtp.messagingengine.com | 10 |
| @ | MX | in2-smtp.messagingengine.com | 20 |
| @ | TXT | v=spf1 include:spf.messagingengine.com ?all | - |
The three DKIM CNAME rows are missing until a domain is typed above; everything else here is already final.
- This builds every record Fastmail documents for a custom domain; it does not check that they are already live in DNS - the MX lookup tool next door does that once they are published.
- An older domain may already carry a fourth DKIM CNAME, mesmtp._domainkey, from before Fastmail settled on the three selectors above - it is deprecated, and this generator will not emit it for a new setup.
What this is
This Fastmail DNS records custom domain generator is the one mail-provider page in this set with nothing left for you to fill in by hand: Fastmail's own DKIM targets embed the domain itself, so typing it once fills in all three CNAMEs at the bottom of the set.
A Fastmail custom domain needs six records in total: two MX records pointing at Fastmail's own mail servers, one SPF TXT record naming Fastmail as the sender, and three DKIM CNAME records that each point at a per-selector signing key.
What makes Fastmail unusual among mail providers is that none of the six is tenant-opaque. Other providers generate a DKIM key behind a login wall; Fastmail's DKIM targets are built from the domain name alone, following a pattern anyone can compute by hand - this page just does the substitution for you.
For why MX alone routes mail but needs an SPF TXT record alongside it to be trusted, see our blog guide "The DNS records a domain needs, and what each one actually does."
How to read the result
With a domain typed in, every record on this page is final: the two MX lines, the one SPF line and all three DKIM CNAME targets are exactly what belongs in a DNS panel, with the domain already substituted into the three that need it.
With the box empty, the MX and SPF records still show, because they never depended on the domain in the first place - only the three DKIM CNAMEs wait for one, since each target's hostname is literally built out of it.
Common mistakes
What goes wrong most often, and how to tell.
- Publishing only one or two of the three DKIM CNAMEsFastmail signs outgoing mail with a selector it rotates between, so a receiver can land on any of the three during normal signing - publishing fewer than three means some of that mail arrives with a DKIM signature nothing in DNS can verify.
- Typing the domain into a CNAME target as a literal placeholderThe pattern "fm1.<domain>.dkim.fmhosted.com" is not a label to fill in yourself - paste the domain into the box above and this page substitutes it correctly into all three targets at once.
- Assuming DKIM here needs a login-walled console, like other mail providersEvery other mail provider in this batch keeps its DKIM key behind an account login. Fastmail's is the exception: its targets are computed from the domain alone, so there is nothing to copy from a dashboard at all.
- Adding the old mesmtp._domainkey record to a new domainAn older Fastmail domain may still carry a fourth DKIM CNAME, mesmtp._domainkey, from before Fastmail settled on the three fm1/fm2/fm3 selectors above. It is deprecated - leave it alone if it is already there, but do not add it to a domain being set up now.
Questions
What people ask about this tool.
- Fastmail signs outgoing mail with a selector that rotates between three keys, and a receiver can check a message against any of them, so all three CNAME records - fm1, fm2 and fm3, each under "._domainkey" - need to be published together for signing to verify reliably.
- No - once your domain is typed into the box above, each of the three targets already has it substituted in correctly. That is the one thing to get right with Fastmail's DKIM setup, and this page does it for you rather than leaving it as a placeholder.
- Fastmail's mail servers and SPF include are the same for every custom domain it hosts, so neither one depends on what you type - only the three DKIM CNAME targets are built from the domain itself, and those wait until one is entered.
- It marks mail from an unlisted sender as neutral rather than rejecting or merely flagging it, which is the qualifier Fastmail itself publishes in its own setup documentation - add senders through the SPF generator rather than changing this line by hand.
Sources
Every fixed value here comes from the provider’s own documentation. These pages change, so each says the day it was last read.
- Fastmail, “Manual DNS Configuration” read 12 October 2026
Use it from the API
The same check, as one request.