Beskos
Get started

Getting started

Publish your DNS records

The required records, their function and how to confirm publication.

Updated:

Contents

DNS publication is performed by the domain administrator. Until the records resolve, mail addressed to the domain is delivered to the previous provider and mail sent from Beskos fails authentication at the receiving server. The administration panel verifies the records.

Location

Administration → Domains → the domain. The screen lists each record with its exact value. An export in BIND format is available and is accepted directly by Cloudflare, Route 53 and most DNS panels.

Record set

The records name the organisation's domain and carry its DKIM key. The format is:

acme.com.                     IN MX    10 mail.beskos.com.
acme.com.                     IN TXT   "v=spf1 mx include:_spf.beskos.com -all"
beskos._domainkey.acme.com.   IN TXT   "v=DKIM1; k=rsa; p=MIIBIjANBg..."
_dmarc.acme.com.              IN TXT   "v=DMARC1; p=reject; rua=mailto:postmaster@acme.com"
mta-sts.acme.com.             IN CNAME mta-sts.beskos.com.
_mta-sts.acme.com.            IN TXT   "v=STSv1; id=138449342089700316"
_smtp._tls.acme.com.          IN TXT   "v=TLSRPTv1; rua=mailto:postmaster@acme.com"

Function of each record

All records are required for mail delivery and authentication.

  • MX — the destination for mail addressed to the domain.
  • SPF — the servers authorised to send on behalf of the domain.
  • DKIM — signs outbound mail so that receivers can verify it was not modified.
  • DMARC — instructs receivers how to handle messages that fail the checks above. The published policy is p=reject.
  • MTA-STS — requires other servers to use encryption when delivering to the domain.
  • TLS reporting — reports failed attempts to connect over an encrypted channel.
  • SRV and autoconfig — allow Outlook and Thunderbird to configure themselves from the address.

Propagation time

The MX and DKIM records determine when the domain becomes active. Activation normally completes within one minute of those records resolving. The last recorded test completed in 31 seconds from publication to a working mailbox.

Longer delays are usually caused by DNS caching. A query issued before publication may be retained by resolvers for several hours. The panel reports which record it is still querying.

Independent verification

The mail check reads the same records from outside the platform and reports the result a receiving server obtains. It is available without an account.

Next: Invite your team →