Email Security
Receiving and sending emails
How domain email works, what MX records do, and how to connect common email providers to your domain.
Your domain is the name after the @ in your email address, such as yourcompany.com. Behind the scenes, receiving email and sending email are handled separately in your domain's DNS settings.
Because the two are separate, you can read and reply to daily team mail in one service (such as Google Workspace or Microsoft 365) while sending product receipts, password resets, or newsletters through another service (such as Postmark or Resend).
How receiving email works: MX records#
When someone sends an email to alex@yourcompany.com, their mail server looks up your domain's MX records (Mail Exchanger records). An MX record tells the internet which mailbox provider accepts incoming mail for your domain.
Each MX record has two parts:
- Priority (or preference): a number that controls the order servers are tried. Lower numbers come first (for example, priority
1or10is tried before20). - Mail server (host): the address of your provider's incoming mail server.
If your domain has no MX records, it can still send email, but nobody can reply to addresses on that domain.
Common email providers and example MX records#
Choose one mailbox provider to receive mail for a given domain (never mix MX records from two different providers on the same domain). Always copy the exact records shown in your provider's setup wizard.
Google Workspace#
| Field | Value |
|---|---|
| Example MX record | 1 smtp.google.com |
| Setup guide | Google Workspace MX setup |
Microsoft 365#
| Field | Value |
|---|---|
| Example MX record | 0 <your-domain-key>.mail.protection.outlook.com |
| Setup guide | Microsoft 365 DNS records |
Fastmail#
| Field | Value |
|---|---|
| Primary MX | 10 in1-smtp.messagingengine.com |
| Secondary MX | 20 in2-smtp.messagingengine.com |
| Setup guide | Fastmail MX records |
Zoho Mail#
| Field | Value |
|---|---|
| Primary MX | 10 mx.zoho.com |
| Secondary MX | 20 mx2.zoho.com |
| Tertiary MX | 50 mx3.zoho.com |
| Setup guide | Zoho Mail MX configuration |
Proton Mail#
| Field | Value |
|---|---|
| Primary MX | 10 mail.protonmail.ch |
| Secondary MX | 20 mailsec.protonmail.ch |
| Setup guide | Proton Mail custom domain setup |
How sending email works#
Unlike incoming mail, outgoing mail does not use MX records. Any server on the internet can try to send an email that claims to come from @yourcompany.com.
To stop impersonators and prove which emails are genuinely yours, inboxes check three security settings on your domain:
- SPF: lists every service allowed to send email for your domain.
- DKIM: adds a cryptographic digital signature to each outgoing message.
- DMARC: tells inboxes to quarantine or block messages that fail SPF and DKIM, and requires the authenticated domain to match the "From" address (alignment).
Once those three protections are in place, BIMI lets Gmail and other supporting inboxes display your official logo and blue verified checkmark next to your messages.