Fastmail SPF and DKIM setup

What you are setting up

Fastmail is a mailbox host: it receives and sends the everyday mail for people on your domain, which is why the setup covers MX as well as SPF and DKIM. You add the domain in Fastmail, publish the records it lists, and Fastmail signs outgoing mail as your domain so it aligns. Two things trip people up: DKIM is three CNAMEs rather than one TXT key, and the SPF record Fastmail suggests ends in ?all, which is weaker than most guides expect.

Publish SPF and DKIM

In Fastmail, go to Settings > Domains, click Add or buy domain, and choose Use a domain you already own. Custom domains need at least one admin on a non-Basic plan. If you keep DNS at your registrar or DNS host (the usual case), Fastmail lists these records for you to add:

Type:  MX
Host:  @
Value: in1-smtp.messagingengine.com   (priority 10)
Value: in2-smtp.messagingengine.com   (priority 20)

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:spf.messagingengine.com ?all

Type:  CNAME   (DKIM, three records)
Host:  fm1._domainkey     Value: fm1.yourdomain.com.dkim.fmhosted.com
Host:  fm2._domainkey     Value: fm2.yourdomain.com.dkim.fmhosted.com
Host:  fm3._domainkey     Value: fm3.yourdomain.com.dkim.fmhosted.com

The CNAME targets contain your domain in the middle, so fm1._domainkey.example.com points at fm1.example.com.dkim.fmhosted.com. Because they are CNAMEs, Fastmail hosts the actual keys and you never paste a p= value. Publish all three; do not stop at fm1. If you already have an SPF record, merge include:spf.messagingengine.com into it rather than adding a second one. If you let Fastmail host your nameservers instead, it publishes all of this for you and you can skip this section.

Domains set up before 2018 may still carry a mesmtp._domainkey CNAME. Fastmail lists it as deprecated; the three fm records are the current set.

Add DMARC

Fastmail's own instructions suggest a bare v=DMARC1; p=none; at _dmarc. Add a reporting address so you actually see who is sending as your domain:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Fastmail gotcha

The suggested SPF ends in ?all. That is the neutral qualifier: it tells receivers that a sender not in the list is neither authorized nor unauthorized, which in practice is close to publishing no policy at all. Fastmail lists it that way so mail from other services you have not added yet is not penalized. Once you have your senders in your SPF record, change it to v=spf1 include:spf.messagingengine.com ~all so an unlisted sender softfails. Your Fastmail mail is unaffected either way, because it passes DMARC on aligned DKIM.

The second thing to watch is the DNS host appending your domain to the CNAME target, giving fm1.yourdomain.com.dkim.fmhosted.com.yourdomain.com. If your DNS editor does that, add a trailing dot to the target or check the resolved name afterwards. And if you send from a subdomain, add it in Settings > Domains as its own domain and publish its own records; the apex records do not cover it.

Confirm it worked

• Check the domain in Fastmail. Settings > Domains shows a green tick once it detects your DNS entries are complete, and a red mark on anything it cannot find. DNS usually settles in minutes but can take up to a day.
• Send a test and read the headers. Send from your Fastmail mailbox, open the message, and confirm the DKIM signature shows d=yourdomain.com with an fm1, fm2, or fm3 selector, and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Fastmail should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.