Corporate Email Setup: How to Configure DNS Records

To create a corporate email account, you first need a mail service connected to your domain and administrative access. Then you create mailboxes, point the MX record to the provider’s server, and add SPF, DKIM, and DMARC records. If these records are incorrect, the address may work while messages are delayed, rejected, or sent to the recipient’s spam folder.

What access is needed before setting up corporate email?

Before starting, verify that you can access your domain’s DNS management and the administration panel of the mail service you selected. In a shared hosting panel, email account creation and DNS screens may be in the same place; with a separate corporate mail service, the mailbox panel and domain DNS panel are different systems. This distinction matters: creating a mailbox does not automatically direct the domain’s mail traffic to the correct server.

Export the domain’s existing DNS records, or at least note the name, type, value, and TTL of the records you will change. TTL is the period that determines how long DNS information can remain cached on other servers. Do not change multiple records at the same time; if a problem occurs, this makes it possible to identify which change caused it.

Setup order: from the mailbox to DNS verification

1. Create the mailbox: Add your domain in the service panel and define an address such as name@yourdomain.tld. If sending and receiving addresses are different, make a note of this. If the address cannot be created, the problem is not DNS but the service account or domain verification; first complete the verification step shown in the panel.
2. Review the MX records: In DNS management, find the records whose type is MX and compare them with the server names provided by the mail provider. If MX records belonging to the old hosting provider remain, incoming messages may go to the wrong server. Add the records requested by the provider, and remove old MX values that are no longer used only after the move to the new service has been completed. After the change, send a new test message; if it goes to the old mailbox, investigate DNS caching or any remaining MX record.
3. Check the SPF record: SPF is a TXT record that states which servers are allowed to send messages on behalf of your domain. If an SPF record already exists in the DNS screen, do not add a second SPF record; update the existing record so that it includes the sending source recommended by the provider. Multiple SPF records can cause a verification error. If only your corporate mail service sends messages, define its source; if a website form or another service also sends messages, each of these sources must be verified separately.
4. Enable the DKIM signature: DKIM uses a cryptographic signature to verify that an outgoing message came from an authorized system. The mail panel generally generates a selector name and a TXT or CNAME record. Enter this value in DNS without changing it. If the DKIM status does not appear as verified in the panel, first check that the record name was entered completely and that the panel has not automatically added the domain name again at the end. If the only finding is a DKIM verification error, correct the DKIM record instead of changing the MX record.
5. Add the DMARC policy: DMARC determines what the recipient server should do when SPF and DKIM results do not align with the domain. For the initial setup, choosing a policy that collects reports and does not immediately reject messages helps you identify legitimate senders that have not yet been defined. If you use a reporting address, make sure it is a mailbox that belongs to you and is secure. Applying a strict rejection policy before all third-party senders have been verified can prevent legitimate messages, such as invoices or newsletters, from being delivered.
6. Repeat the test and review the new evidence: Repeat the operation that failed before the changes with the same recipient and a similar message, and note the sending time. In the recipient’s message headers, review the SPF, DKIM, and DMARC results; in the mail service’s delivery logs, review the new event in the same time range. If only DKIM fails in the new record, correct the signature record; if SPF fails, correct the record content for the service that sent the message. If the test succeeds, observe that the transition is complete rather than deleting the old records immediately.

What does it mean if corporate email goes to the spam folder?

A message landing in the spam folder does not, by itself, mean there is an MX error. The recipient server received the message but may have classified it based on authentication results, sender reputation, content, or the recipient’s own policy. If the message does not arrive at all, first examine the MX and delivery records; if it arrives but goes to spam, examine the SPF, DKIM, and DMARC results and the message headers separately.

Suppose a company has moved to a new mail service and a test message leaves the sender’s mailbox but lands in the recipient’s spam folder. If the headers show that SPF and DKIM pass while DMARC appears misaligned, check whether the sending domain aligns with the signing domain; changing the MX record again would not target the issue. If SPF appears to fail, an additional sender, such as the website’s message form, may not be defined in the SPF record. First verify whether this service actually sends messages, then add only the necessary record.

Safe rollback if the change does not work

DNS updates may appear at different times depending on the provider and caches. Therefore, do not treat the result at a single recipient as conclusive evidence immediately; run the same test with another recipient, preferably using a different mail service. If the problem continues after the change, restoring the old value you recorded is a safe rollback option, especially during a transition in which incoming messages are being lost. However, first check whether the new and old MX records are present together, and then check the time match in the mail service’s delivery log.

After setup, it is useful to keep the domain, mailbox, and DNS records in one document and to reassess the effect on SPF, DKIM, and DMARC whenever a new website form, newsletter tool, or CRM sender is added. When comparing hosting and domain management options, you can review the relevant service information on İyibirNet; however, for DNS values, always rely on the current panel of the mail provider you use.

Next safe step

First, make a copy of the existing DNS records, then compare only the MX record with the values provided by your mail provider. After the incoming message reaches the correct mailbox, add the SPF, DKIM, and DMARC records one at a time and perform a new time-stamped test after each change.