DNS and authentication

Inbox providers accept mail they can authenticate. Werkmail issues the records; you publish them (or apply them with Cloudflare). Fetch the live set for a tenant:

curl -sS -H "Authorization: Bearer $TOKEN" \
  "$BASE/api/practices/$PRACTICE_ID/dns-records"

GET …/check-dns re-queries public DNS. GET …/deliverability adds MAIL FROM, DMARC, BIMI, and inbound MX guidance.

DKIM

The outbound platform gives CNAME tokens for the domain identity (the sending host, not a single mailbox). Publish every token. If your DNS dashboard can proxy records, DKIM CNAMEs must stay DNS-only.

The CNAME targets are product-branded (*.dkim.werkmail.eu). That is DNS only. The DKIM header d= on a delivered message is still your domain (once verified) plus a second signature from the outbound platform. See Raw source and branding.

Subdomain From addresses need DKIM on that subdomain, not only on the parent apex.

SPF

One SPF TXT on the sending apex. Subdomain practices reuse the parent SPF — do not publish a second SPF on the subdomain unless that host is itself the sending apex. Multiple SPF TXT records on one name fail authentication.

MAIL FROM (bounce domain)

MAIL FROM must be a subdomain of the verified identity, typically bounce.<sending-host>. Publish the MX/TXT pair returned by dns-records. Use relaxed SPF alignment in DMARC (aspf=r). Strict SPF alignment (aspf=s) never aligns with bounce MAIL FROM.

DMARC

Exactly one _dmarc TXT on the sending apex. Recommended starting policy:

v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r; rua=mailto:dmarc-reports@werkmail.eu; fo=1

If you send From a subdomain, also publish _dmarc.<subdomain> with the same policy. Many testers and some receivers do not walk up to the parent DMARC.

BIMI (optional)

default._bimi.<apex> pointing at a stable HTTPS SVG logo. Omit the a= VMC tag until you have a certificate. The logo host must stay HTTPS.

Inbound MX (optional)

Receiving is opt-in and uses in.<your-domain> only. Never publish Werkmail MX on the apex — that would capture the whole domain’s inbox. See Inbound.

Cloudflare apply

When a Cloudflare API token is configured, onboarding can create DKIM, SPF, MAIL FROM, and DMARC as DNS-only records. Domain Connect is the browser alternative. GET …/dns-records/cloudflare-zone exports BIND for copy-paste.

Custom domain vs managed host

• Custom domain: you own mail.yourbrand.example. Werkmail returns CNAMEs for you to add.
• Managed host: a {slug}.werkmail.eu identity is provisioned for evaluation. You can later attach a custom domain with POST …/custom-domain.