Adding your domain
The setup wizard has three steps: Identify, Link and Monitor. You type your domain, add a few CNAME records at your DNS host, and press Activate. Nothing about how your mail is delivered changes along the way.
Step 1: Identify
Type the domain you send mail from, such as example.com. You can paste a full address: the wizard removes https://, any path, port or trailing dot, spaces and capitals, so https://Example.com/contact becomes example.com. It does not remove www., because www.example.com is a different name; add the domain your From addresses use.
Step 2: Link
The wizard lists the records to add at your DNS host. Every value is specific to your domain, so copy it from the wizard rather than from this page.
| Host | Type | What it is for | Plan |
|---|---|---|---|
_dmarc | CNAME | Your DMARC record, starting at p=none | All plans |
_smtp._tls | CNAME | TLS reporting (TLS-RPT) | All plans |
_mta-sts | CNAME | The MTA-STS policy version | Business and above |
mta-sts | CNAME | The host receivers fetch your MTA-STS policy from | Business and above |
That is all the wizard asks for. Leave your SPF record alone for now: when you activate, we read the senders it authorizes and carry them into ours, and step 3 gives you the single record to replace it with. DKIM is set up later from the DKIM page, and BIMI from the BIMI page once your logo is uploaded and DMARC is enforcing.
How each row is checked
We ask your DNS host's own nameservers, not a public resolver, so a row turns green as soon as your DNS host publishes the record. Public resolvers such as 8.8.8.8 only tell you how far the change has spread: a row can read "Live at your DNS host; visible to 2 of 4 public resolvers so far". Some mail receivers can take a few hours to see a new record. You can close the page and come back; the wizard keeps checking while it is open.
| State | What it means | What to do |
|---|---|---|
| Live | Your DNS host serves exactly the value we expect. | Nothing. |
| Not live yet | Nothing is published at that name yet. | Add the record, or wait for your DNS host to publish it. |
| Wrong record: mismatch | A CNAME is there, but it points somewhere else. | Change its value to the one shown. |
| Wrong record: conflict | A TXT record already exists at that name, and DNS does not allow a CNAME beside it. | Delete the TXT, then add the CNAME. |
| Could not check | Your nameservers did not answer in time. This is usually temporary. | Wait and press Check now. |
A row that has been confirmed stays green. If a later check gets no answer, the row says when it was last confirmed instead of turning red.
The doubled-suffix mistake
Many DNS hosts add your domain to whatever you type in the host field. Typing _dmarc.example.com then creates _dmarc.example.com.example.com. The wizard looks for this and tells you: "your DNS host added example.com to the host a second time". Type the host alone (_dmarc). The same can happen to the value: if the wizard says your DNS host added your domain to the end of the value, end the value with a dot so it is not treated as relative to your domain.
If you already have a _dmarc record
DNS does not allow a CNAME and a TXT at the same name, so delete your current _dmarc TXT record first. Ours starts at p=none. If your current record already enforces (p=quarantine or p=reject), switching drops enforcement until you raise the policy again from the DMARC page, and stepping up needs reports on at least 10 of the last 14 days unless you confirm the risk (see the ladder). If you would rather not drop enforcement at all, skip the _dmarc record for now and keep managing DMARC yourself; everything else still works. If your current record's rua= sends reports to another service, they will come to us instead.
Activate
Press Activate Sentra-Link when the rows are green, or Try activating now before that. Activation needs only the _dmarc CNAME. When it succeeds we publish your records in our zone: DMARC at p=none, TLS-RPT, and on Business and above an MTA-STS policy in testing mode and a hosted SPF record seeded with the senders your current SPF record lists.
Step 3: Monitoring connected
Your domain is verified. Reports arrive once receivers see mail from the domain, typically within a day. DMARC starts at p=none: we watch who sends as you and block nothing until you choose to enforce.
On Business and above, step 3 also shows a card titled One more record: SPF. It gives you the single value to replace your existing SPF record with. Edit the record you have; do not add a second one. The same card stays on the SPF page until the swap is live. See Moving your SPF.