Adding DNS Records to Verify Your Domain
Two MX records, an SPF record, and a DKIM record — what to add, where to add them, and why verification sometimes takes days.
Leaving comments on pages means nothing if your messages don't reach the people you're trying to reach. Authenticating your domain is what lets Atarim send email as you instead of from a generic address, and it's one of the biggest factors in whether those emails land in an inbox or a spam folder. Four DNS records are what make this work: two MX records so Atarim can receive, and an SPF and a DKIM record so it can send as you. They all sit on a dedicated subdomain, so your existing email keeps working exactly as it does now, whether that's Google Workspace, Microsoft 365, or anything else.
Step-by-Step Guide
What Domain Authentication Actually Does
Setting up the Atarim Inbox has two halves, and they’re easy to confuse:
You can use the Inbox with only the first half complete. The second half is what protects your deliverability and makes replies look like they came from your agency.
Each domain you authenticate must first be used as the Inbox Email Address on your account. Once added, your domain is assigned its own set of DNS record values — which is why the email address has to be saved before there’s anything to copy.
Why this won’t disturb your existing email
Every record Atarim gives you belongs to a dedicated subdomain, atarimio5125.yourdomain.com, which is a separate namespace from your domain itself:
@yourdomain.com mail to Google Workspace, Microsoft 365, or wherever it goes today. The new MX records only apply to the subdomain.selector._domainkey.yourdomain.com. The new one sits under the subdomain and never collides with them.The safety of this depends entirely on the records landing on the subdomain. Every record you save should have atarimio5125 somewhere in its name. If one doesn’t, delete it and add it again — see the hostname section below.
What Each Record Does
Four records in total:
| Record | Count | What it’s for |
|---|---|---|
| MX (Mail Exchange) | 2 | Identify which mail servers accept incoming email for the subdomain. Both are required. |
| SPF (Sender Policy Framework) | 1 TXT | Identifies which servers are allowed to send email using your domain, which reduces the risk of spoofing. |
| DKIM (DomainKeys Identified Mail) | 1 TXT | Signs your outgoing mail so the message arriving at the recipient’s inbox is provably identical to the one you sent. |
Step 1: Set Your Inbox Email Address
This is the address clients will see replies coming from, so use one you are happy to publish.
Instructions:
What happens: Atarim creates a dedicated mail subdomain from your address’s domain and generates the DNS records you’ll add in the following steps. If your address is hello@youragency.com, the subdomain is atarimio5125.youragency.com.
You can also reach the same wizard from the sidebar. Before setup, the Email Inbox appears in your project list as Activate Inbox with a warning icon and the subtitle Connect Your Email Inbox.
Step 2: Set Up Forwarding and Verify It
The wizard moves to Step 2 — Domain Verification. This step holds both verifications.
Instructions:
The button shows a loading state, then changes to Verified with a check icon and becomes inactive.
If it fails: after roughly 20 seconds you’ll see an error asking you to confirm forwarding is set up correctly. A Cancel button is available while it’s checking. Re-check the rule and select Verify Forwarding again.
Step 3: Locate Your DNS Records
Atarim generates four records specific to your domain. Copy them from here rather than from any other guide.
Instructions:
Rows 3 and 4 are both listed as TXT. Row 3 is your SPF record — its value starts v=spf1. Row 4 is your DKIM record — its value starts k=rsa, and its host contains _domainkey.
The Host and Value cells are truncated on screen. Always use the copy button on each cell rather than reading the visible text — what you can see is not the whole value.
Your DKIM host begins with a selector that is generated for your domain, so it will not match anyone else’s. Copy it exactly as shown rather than typing what you expect it to be.
The MX rows and the TXT rows are built differently behind the scenes. The two MX hosts are a short prefix with no domain on the end. The two TXT hosts are complete hostnames with your domain already included. Paste each one, check what your provider saved, and adjust — see the next section.
Step 4: Add the Records at Your DNS Provider
The wording differs by provider, but the shape is the same: find the DNS management screen, add each record, save. The steps below use GoDaddy.
Adding the MX records
Both MX records are required, and they are identical apart from the Mailgun hostname.
Instructions:
atarimio5125, Points to: mxa.mailgun.org, Priority: 10, and the lowest TTL your provider allows.mxb.mailgun.org as the Points to value. Everything else is identical.Adding the SPF record
SPF tells receiving servers that Mailgun is allowed to send on your behalf, which is what keeps replies out of spam.
Instructions:
atarimio5125 — the displayed value with .yourdomain.com removed.v=spf1 include:mailgun.org ~all.Adding the DKIM record
DKIM signs your outgoing mail. The string is long — paste it rather than typing it.
Instructions:
_domainkey. It is displayed as a complete hostname ending in your domain. GoDaddy appends your domain automatically, so remove .yourdomain.com from the end before entering it.
A note on the Priority column
Atarim shows a Priority value on all four rows. Priority only applies to MX records — enter 10 on the two MX records and ignore it on the SPF and DKIM records. Most DNS providers don’t offer a priority field for TXT records at all.
Other providers
Cloudflare — Select your domain, open DNS > Records, then Add record. Enter the Host in Name and paste the Value into Mail server for MX or Content for TXT. Set Priority to 10 on the MX records. TTL can stay on Auto. MX and TXT records can’t be proxied, so there’s no orange cloud to disable.
Namecheap — Go to Domain List > Manage > Advanced DNS, then Add New Record. Choose MX Record or TXT Record, enter the Host, paste the Value, set Priority to 10 on the MX rows, leave TTL on Automatic, and save each row with the green tick.
cPanel — Open Zone Editor, select Manage next to your domain, then Add Record. Fill in Name, TTL, Priority, and Record/Value for each.
Check the Hostname Before Saving
This is the single most common reason verification fails, and it catches people specifically because Atarim displays the four hosts in two different formats.
Many DNS providers automatically add your domain name to the end of any hostname you enter. Since the SPF and DKIM hosts are already displayed with your domain included, pasting them as-is at one of those providers duplicates the domain and the record will never verify.
Example. Your domain is yourdomain.com and Atarim displays the SPF host as atarimio5125.yourdomain.com. If your provider auto-appends and you paste that in whole, it saves as:
atarimio5125.yourdomain.com.yourdomain.com
What to do:
Providers disagree about whether to append your domain to a host, and getting it wrong is the most common reason verification fails.
Instructions:
.yourdomain.com from the end of the two TXT hosts before saving them.atarimio5125.yourdomain.com.Whichever way your provider works, every saved record should end in your domain exactly once. If you can see yourdomain.com.yourdomain.com anywhere, that record will not verify.
Equally, don’t strip too far. Every saved record must still contain atarimio5125. A record saved with an empty host, or a host of @, lands on your root domain instead of the subdomain.
Step 5: Verify Your Domain in Atarim
DNS changes take time to propagate, so a failed check straight after saving does not necessarily mean a mistake.
Instructions:
The Verified column shows a green check on all four rows, and the button changes to Verified and becomes inactive.
DNS Propagation
DNS changes take time to apply. If your domain doesn’t verify immediately, wait and select Verify DNS Records again later. Propagation time depends on your provider and on the TTL of any record you’re replacing, and can take up to 72 hours.
If it still doesn’t verify after 72 hours:
Instructions:
smtp._domainkey. prefix.What Changes Once Verification Passes
Once forwarding verifies, the sidebar item changes from Activate Inbox to your Inbox project, and a gear icon appears next to it for Email Settings.
Once all four DNS records verify, outgoing email sends from your own address with proper authentication, rather than from Atarim’s default sender.
To change anything later, select the gear icon to open Email Settings. It has four tabs — Account, Domain, Signature, and Notifications — and you can re-run either verification from the Domain tab without going through the wizard again. To start over completely, use Reset Wizard on the wizard’s completion screen.
Resources
For your convenience, here is a list of links to the instructions for adding DNS records at commonly used hosts:
FAQs
Do I have to verify my domain before I can use the Inbox?
No. Forwarding verification is what activates the Inbox. Domain verification only controls which address your outgoing email sends from.
Will these records break my existing email?
No, as long as they land on the subdomain. Every record belongs to atarimio5125.yourdomain.com, which is separate from your domain itself, so your root MX, your existing SPF record, and your current DKIM keys are all untouched. The one way to cause a problem is saving an MX record on the root domain by mistake — check that every saved record still has atarimio5125 in its name.
Do I need a DMARC record?
Atarim doesn’t ask for one and doesn’t check for one. If your domain already publishes DMARC on default settings, Atarim’s mail passes. If your policy uses strict alignment, it can fail even with all four records verified, because your address stays in the From header while the mail is signed by the subdomain.
Can I verify my domain before entering my email address?
No. The records are generated from the domain of the address you enter in Step 1, so there’s nothing to verify until that’s saved.
Both TXT rows just say TXT — which is SPF and which is DKIM?
Look at the value. Row 3 starts v=spf1 and is your SPF record. Row 4 starts k=rsa and has _domainkey in its host — that’s DKIM. You don’t need to tell them apart to add them, as long as each host stays paired with the value on its own row.
How long should verification take?
Most providers propagate within 15 to 30 minutes, but it can take up to 72 hours. If it hasn’t verified after that, check the saved records before contacting support.
Where do I change these settings after setup?
Select the gear icon next to your Inbox project to open Email Settings, then use the Domain tab. You can also return to Settings > Communication > Inbox Setup.
Conclusion
By following these steps, you can successfully authenticate your domain, ensuring improved email deliverability and security when sending messages via app.atarim.io.
Tips & best practices
- Double-check record values before saving to prevent authentication failures.
- Use a DNS checker tool (e.g., MXToolbox) to confirm propagation.
- If issues persist after 72 hours, contact your domain provider for assistance.