Fastmail email DNS checker
Check the public DNS records that matter when Fastmail is not receiving, sending, verifying, or passing authentication for a custom domain.
Fastmail can host mailboxes for a custom domain, but public DNS still decides whether mail reaches Fastmail and whether outgoing mail authenticates correctly.
Fastmail also offers two ways to manage that DNS - switch the domain's nameservers to Fastmail so records are edited inside Fastmail, or keep your existing DNS host and add the records manually. Use this page to confirm which setup is active and to avoid guessing the domain-specific DKIM targets Fastmail generates.
DNS records to check first
| Record | What to check | Safe note |
|---|---|---|
| Nameservers | Confirm whether the domain's nameservers point at Fastmail or stay with your registrar, Cloudflare, or another DNS host. With Fastmail's nameserver option, DNS is edited inside Fastmail; otherwise you add the records manually at the existing host. | Records only take effect at the DNS host the nameservers make active - editing Fastmail's DNS page while the nameservers point elsewhere, or the reverse, changes nothing publicly. |
| MX | Confirm the domain's MX records match the destinations shown in Fastmail's DNS setup screen. Fastmail's documented hosts are in1-smtp.messagingengine.com at priority 10 and in2-smtp.messagingengine.com at priority 20. | Treat these as the publicly documented starting point and confirm the exact hostnames and priorities in Fastmail's DNS setup screen, removing old provider MX records only after migration is complete. |
| SPF | If Fastmail sends mail for the domain, the SPF record commonly includes spf.messagingengine.com. | Confirm the exact SPF value in Fastmail's DNS setup screen and merge it with any other real senders in one record; publishing a second SPF record breaks SPF for everyone. |
| DKIM | Fastmail uses three DKIM CNAME records named fm1._domainkey, fm2._domainkey, and fm3._domainkey, each pointing at a target generated for your domain. | Copy the three exact CNAME targets from Fastmail's DNS setup page. Do not invent the targets - they are domain-specific - and keep the records DNS-only if your DNS host offers proxying. |
| DMARC | Publish a DMARC record once SPF and DKIM are in place so receivers know how to handle messages that fail alignment. | Start with a monitoring policy such as p=none until reports show Fastmail and any other senders passing authentication. |
| Fastmail domain setup | Confirm the domain has been added in Fastmail's settings and the receiving address exists as a user or alias. | Correct MX records route mail to Fastmail, but they do not create the mailbox or alias - that happens inside Fastmail. |
Common mistakes
- Adding Fastmail's records at the registrar while the domain's nameservers point at Fastmail or another DNS host, so the edits never reach public DNS.
- Publishing only one or two of the three fm1, fm2, and fm3 DKIM CNAME records, or copying the targets from another domain.
- Adding spf.messagingengine.com as a second SPF record instead of merging it into the existing one.
- Leaving an old provider's MX records alongside Fastmail's after moving mailboxes.
Boundaries
Domain Email Doctor checks public DNS records only and does not access a Fastmail account.
Domain setup, user and alias creation, and the choice between Fastmail nameservers and manual records stay inside Fastmail's settings.
The three DKIM CNAME targets are generated for your domain and must come from Fastmail's DNS setup page, and a passing DNS check does not guarantee inbox placement.