Connect a domain

What Zylar checks when you connect a sending domain (SPF, DKIM, DMARC, tracking domain, MX), how to fix issues, and example records for Google and Microsoft.

Every inbox in Zylar sends from a domain you own, so the domain is the first thing you connect. The moment you connect it, Zylar checks its DNS for SPF, DKIM, DMARC, a custom tracking domain and MX. If a record is missing or wrong, Zylar tells you exactly what to fix and gives you the record to paste into your DNS provider.

What Zylar checks on connect

Record	What it does	Why it matters for cold email
SPF	A TXT record listing the servers allowed to send mail for your domain.	Receivers reject or junk mail from servers your SPF record doesn't authorize.
DKIM	A public key in DNS that receivers use to verify your messages' cryptographic signature.	Proves the message wasn't altered and really came from your domain.
DMARC	A TXT record at `_dmarc` that tells receivers what to do when SPF or DKIM fail, and where to send reports.	Gmail and Yahoo require DMARC for bulk senders, and it ties SPF and DKIM to your visible From domain.
Custom tracking domain	A subdomain of your own used for open and click tracking.	Tracking links on a shared domain inherit other senders' reputation. Your own keeps links aligned with your domain.
MX	Records that say which servers receive mail for your domain.	A domain that can't receive mail looks suspicious, and you need it to receive replies.

For a full explanation of each protocol, read How to set up SPF, DKIM and DMARC for cold email.

How to connect a domain

Connect your domain in your Zylar workspace.
Review the check results. For each failing record, Zylar shows what to fix and the exact record to paste.
Sign in to your DNS provider (usually your registrar) and add or edit the records.
Let Zylar re-check the domain. DNS changes can take time to propagate, so a record you just added may not pass immediately.

Use the values Zylar shows you for your domain. The examples below show what standard records look like for the two most common mailbox providers, so you can recognize them.

Free SPF / DKIM / DMARC checkerCheck any domain in seconds. No signup.Check now

Example records: Google Workspace

These are Google's documented values for a domain that sends only through Google Workspace. Sources: MX records, SPF, DKIM, DMARC.

Type   Host                  Value
MX     @                     smtp.google.com              (priority 1)
TXT    @                     v=spf1 include:_spf.google.com ~all
TXT    google._domainkey     v=DKIM1; k=rsa; p=<public key from the Google Admin console>
TXT    _dmarc                v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Notes:

Google's single MX value is smtp.google.com. Older setups that use the legacy aspmx values are still supported.
google is the default DKIM selector. You generate the key in the Google Admin console; Google recommends 2048-bit keys.

Example records: Microsoft 365

These are Microsoft's documented formats for a custom domain that sends only through Microsoft 365. Sources: DNS records for Microsoft 365, SPF, DKIM, DMARC.

Type    Host                  Value
MX      @                     <value from the Microsoft 365 admin center>   (priority 0)
TXT     @                     v=spf1 include:spf.protection.outlook.com -all
CNAME   selector1._domainkey  selector1-<yourdomain-com>._domainkey.<initialdomain>.<x>-v1.dkim.mail.microsoft
CNAME   selector2._domainkey  selector2-<yourdomain-com>._domainkey.<initialdomain>.<x>-v1.dkim.mail.microsoft
TXT     _dmarc                v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Notes:

Copy the MX target and both DKIM CNAME targets from the Microsoft 365 admin center or Defender portal. They're specific to your tenant, and Microsoft says the values in its docs are for illustration only.
Microsoft recommends -all (hard fail) in SPF when you also publish DKIM and DMARC.

Rules that apply to every domain

One SPF record per domain. Multiple SPF TXT records cause a permanent error. If you send from more than one service, merge them into a single record with multiple include: values.
Stay under 10 DNS lookups in SPF. Each include: costs at least one lookup, and nested includes add more.
Start DMARC at p=none. Monitor reports first, then tighten to quarantine or reject once you're confident all legitimate mail passes.

Use secondary domains for cold email

Send cold email from secondary domains, not your primary company domain. If a cold domain's reputation drops, your main domain, the one your team uses for customers, invoices and hiring, is unaffected. Microsoft gives the same advice for bulk mail: use a separate domain or subdomain so issues there don't affect your main email domain.

Common practice is to register a few lookalike domains (for example a get or try prefix on your brand) and redirect their websites to your main site. Each one gets its own SPF, DKIM, DMARC, tracking domain and MX, and Zylar checks each one on connect.

Spreading volume across several domains also matters for auto-pause: when one domain is paused, Zylar moves its volume to your other healthy domains. See Monitoring and auto-pause.

Next steps

Add inboxes and let warm-up run.
Read the cold email infrastructure checklist.
See how Zylar handles deliverability end to end.