# DNS and authentication

Inbox providers accept mail they can authenticate. Werkmail issues the records; you publish them (or apply them with Cloudflare). Fetch the live set for a tenant:

```bash
curl -sS -H "Authorization: Bearer $TOKEN" \
  "$BASE/api/practices/$PRACTICE_ID/dns-records"
```

`GET …/check-dns` re-queries public DNS. `GET …/deliverability` adds MAIL FROM, DMARC, BIMI, and inbound MX guidance.

## DKIM

The outbound platform gives CNAME tokens for the **domain identity** (the sending host, not a single mailbox). Publish every token. If your DNS dashboard can proxy records, DKIM CNAMEs must stay **DNS-only**.

The CNAME **targets** are product-branded (`*.dkim.werkmail.eu`). That is DNS only. The DKIM header `d=` on a delivered message is still your domain (once verified) plus a second signature from the outbound platform. See [Raw source and branding](/raw-source-and-branding).

Subdomain From addresses need DKIM on that subdomain, not only on the parent apex.

## SPF

One SPF TXT on the **sending apex**. Subdomain practices reuse the parent SPF — do not publish a second SPF on the subdomain unless that host is itself the sending apex. Multiple SPF TXT records on one name fail authentication.

## MAIL FROM (bounce domain)

MAIL FROM must be a subdomain of the verified identity, typically `bounce.<sending-host>`. Publish the MX/TXT pair returned by `dns-records`. Use **relaxed** SPF alignment in DMARC (`aspf=r`). Strict SPF alignment (`aspf=s`) never aligns with bounce MAIL FROM.

## DMARC

Exactly one `_dmarc` TXT on the sending apex. Recommended starting policy:

```
v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r; rua=mailto:dmarc-reports@werkmail.eu; fo=1
```

If you send From a subdomain, also publish `_dmarc.<subdomain>` with the same policy. Many testers and some receivers do not walk up to the parent DMARC.

## BIMI (optional)

`default._bimi.<apex>` pointing at a stable HTTPS SVG logo. Omit the `a=` VMC tag until you have a certificate. The logo host must stay HTTPS.

## Inbound MX (optional)

Receiving is **opt-in** and uses `in.<your-domain>` only. Never publish Werkmail MX on the apex — that would capture the whole domain’s inbox. See [Inbound](/inbound).

## Cloudflare apply

When a Cloudflare API token is configured, onboarding can create DKIM, SPF, MAIL FROM, and DMARC as DNS-only records. Domain Connect is the browser alternative. `GET …/dns-records/cloudflare-zone` exports BIND for copy-paste.

## Custom domain vs managed host

- **Custom domain:** you own `mail.yourbrand.example`. Werkmail returns CNAMEs for you to add.
- **Managed host:** a `{slug}.werkmail.eu` identity is provisioned for evaluation. You can later attach a custom domain with `POST …/custom-domain`.