admin
Domain DNS for Team mail
Publish MX, SPF, DKIM, and DMARC so your @yourfirm.com addresses send and receive reliably.
Team workspaces use a custom domain (for example @yourfund.com). DNS must be correct before mail is trusted by recipients and before Finmail activates your workspace.
Where to configure
- Sign in as workspace owner.
- Open the domain wizard at
/onboarding/domainor Settings → Identity → Domain DNS. - Copy each record into your DNS provider (Cloudflare, Route53, registrar portal, etc.).
- Click Verify until MX, SPF, and DKIM show pass.
Records (typical Team setup)
Finmail generates a tenant-specific DKIM key in the wizard. Other values are platform-standard — always use the copy buttons in the app, not this table alone.
| Record | Purpose |
|---|---|
| MX | Mail delivery to Finmail (mx1.finmail.com, mx2.finmail.com) |
| SPF | Authorizes Finmail to send on your domain |
| DKIM | Cryptographic signing (finmail._domainkey.yourdomain) |
| DMARC | Policy for failed authentication (strongly recommended) |
Activation: MX + SPF + DKIM must pass live checks. DMARC is recommended even if not required for first activation.
After activation
- Team members send from
@yourdomainaddresses provisioned in Finmail. - The Identity Verification Center on inbound mail shows real SPF/DKIM/DMARC results from message headers — misconfigured DNS shows explicit fail states.
- Optional: configure third-party mail clients — see External mail clients (
imap.finmail.com:993,smtp.finmail.com:587, full mailbox credentials).
Troubleshooting
| Symptom | Check |
|---|---|
| Verification stuck | DNS TTL propagation (up to 48h); use wizard Verify again |
| DKIM fail | Public key in DNS matches wizard exactly — no extra quotes or line breaks |
| SPF fail | Only one SPF TXT record at @; include Finmail's authorize directive |