Mail DNS records

Each domain on a mail service has its own list of records. To see it, open the service from Email, go to the Domains tab and select the domain. The DNS records card lists every record with the exact value for that domain. This page explains each one.

In the names and values below, example.com stands for your domain and <base> for your service's mail host (see Placeholders).

Publish every record the card lists. Only some of them decide whether the domain is verified (see When a domain is verified); the rest let mail apps set themselves up and tell other mail servers to use TLS.

An SMTP Relay domain gets only the ownership, SPF, DKIM and DMARC records. It gets no MX record, so the domain's inbox stays wherever it is now.

Some domains list one more DKIM record with the note Signs the mail this domain sends through our outbound relay. Publish it as shown; its SPF record then also carries a second include:.

example.com

Your domain, exactly as you added it. A subdomain such as send.example.com gets records under its own name, such as _dmarc.send.example.com.

<base>

The mail host of your service's region, such as mail-fra.coritan.com. The MX suffix row on the service's Overview tab shows yours.

<token>

A random value we make for the domain when you add it. It never changes while the domain is on the service.

<selector>

The name of a DKIM key, such as cor202609r for the RSA key and cor202609e for the Ed25519 key. Every domain has two keys, so it lists two DKIM records.

<key>

The public half of the DKIM key. Copy the whole value from the dashboard.

<id>

A label for the domain's MTA-STS policy. It changes when the policy does, and the dashboard shows the current one.

We ask your domain's own nameservers first, so a record counts as soon as your DNS provider serves it. A problem the check finds shows in the Last problem row of the domain's page, under the domain's name on the Domains tab, and in the toast after Verify now.

Ownership

A TXT record at _mailverify.example.com whose value is exactly mail-verify=<token>. A domain whose records we publish into your zone passes without it. Keep the record in place: a later check that cannot find it sets the domain back to pending.

MX

At least one MX record at the domain names one of the mx hosts the dashboard lists. When the domain has MX records and none of them is ours, the check reports MX points to followed by the hosts it found.

SPF

A TXT record at the domain that starts with v=spf1 and contains _spf.<base>. Other mechanisms in the same record are fine. Keep one SPF record per name: add the include: to the record you have rather than publishing a second one.

DKIM

The TXT record at each selector contains the key the dashboard shows. A missing or different key reports DKIM selector <selector> not published. Until the keys exist, the check reports No DKIM keys yet: the mail engine has not made them.

DMARC

A TXT record at _dmarc.example.com that starts with v=DMARC1, whose p= value is the domain's current stage. A different value reports DMARC publishes p=none, expected p=quarantine (with the values found). See DMARC for the stages.

A domain that has not passed is pending, and the Domains tab shows how many of its checks have passed, such as Pending · 3/5. We check pending domains again about every ten minutes. We do not re-check a verified domain on a timer; Verify now checks it on demand.

Until ownership passes, the list has no DKIM records. We make the domain's keys once we find the ownership record, and the DKIM records then appear on the card.

Type

The record type.

Name

The full name to create. Some DNS providers want only the part before your domain, such as _dmarc for _dmarc.example.com.

Priority

The priority of an MX or SRV record.

Value

What the record holds. An SRV value is its weight, port and target, in that order. A note under a value explains a record that needs something from you.

Status

The result of the last check for that record: Verified or Missing. Only the ownership, inbound MX, SPF, DKIM and DMARC records get one. The others, a retiring DKIM key and the extra DKIM record for the outbound relay have none.

Name and value each have a copy button.

We replace each verified domain's two DKIM keys every 90 days.

When we publish into your zone, we add and delete these records ourselves. When your DNS is elsewhere, the switch waits until you publish the new keys.

When you add a domain whose DNS zone is on Coritan DNS in the same account (the domain's own zone or a parent's), we write its records into the zone ourselves. Ownership passes at once, and the card reads We publish these into your hosted zone and keep them up to date.

• Each record we write has a TTL of 300 seconds and the comment coritan-mail, followed by its purpose, in the zone's record list.
• We update and delete only records with that comment.
• Verify now writes any missing records again before it checks.
• Removing the domain from the mail service deletes only our records.

A record already in your zone always wins over ours:

When the domain is inside a zone on this account's DNS but we are not writing into it (for example, you created the zone after adding the domain), the domain's page shows a Publish to your zone card. Its button, which shows the number of records, creates them through your DNS with a TTL of 3600 seconds. A record that is already there counts as present rather than as a failure.

The card then reports how many records it created, how many were already present and how many it could not publish, with the reason for each. When all of them worked, it checks the domain a moment later. These records do not carry the coritan-mail comment, so we do not update them later: publish again after a DKIM rotation or a DMARC stage change.

A name you claimed under coritan.gg needs no step at all: we publish its records and check the domain when you add it.

• Add a domain to Mail Hosting
• Add a sending domain to SMTP Relay
• DMARC
• Manage DNS records
• Mail troubleshooting

Get a domain's records and its last check:

curl https://api.coritan.com/api/v1/client/mail/4812/domains/311/records \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Use /client/smtp-relay/ in the path for an SMTP Relay service. The response holds the domain and the records to publish:

{
  "domain": {
    "id": 311,
    "domain": "example.com",
    "status": "pending",
    "verification_method": "txt",
    "checks": { "ownership": true, "mx": true, "spf": true, "dkim": false, "dmarc": true },
    "dmarc_policy": "none",
    "dmarc_pinned": false,
    "last_checked_at": "2026-09-16T10:40:12Z",
    "last_error": "DKIM selector cor202609r not published"
  },
  "records": [
    { "type": "TXT", "name": "_mailverify.example.com", "content": "mail-verify=3kP0vS8x", "purpose": "ownership" },
    { "type": "MX", "name": "example.com", "content": "mx1.mail-fra.coritan.com", "priority": 10, "purpose": "inbound" },
    { "type": "TXT", "name": "example.com", "content": "v=spf1 include:_spf.mail-fra.coritan.com -all", "purpose": "spf" },
    { "type": "TXT", "name": "cor202609r._domainkey.example.com", "content": "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBg...", "purpose": "dkim", "selector": "cor202609r" },
    { "type": "SRV", "name": "_imaps._tcp.example.com", "content": "imap.mail-fra.coritan.com", "priority": 0, "weight": 1, "port": 993, "purpose": "autoconfig" }
  ]
}

The example is shortened. Each record has these fields:

type, name, content

The record to publish. name is always the full name.

priority, weight, port

Present on MX and SRV records.

purpose

What the record is for: ownership, inbound, inbound_standby, spf, dkim, upstream_dkim, dmarc, autoconfig, autodiscover, jmap, carddav, tlsrpt or mta_sts.

selector, state

On DKIM records. state is pending for a new key to publish now and retiring for an old key to keep for one more week.

domain.checks holds the result of the last check for ownership, MX, SPF, DKIM and DMARC. To run a check, see Add a domain to Mail Hosting. A domain that is not on the service answers 404 Domain not found.