Fastmail email authentication: SPF, DKIM and DMARC
Fastmail publishes one short set of records for a custom domain: two MX records, one SPF include and three DKIM CNAMEs. This guide shows each record and the parts Fastmail leaves to you, mainly tightening SPF and growing DMARC beyond p=none.
Record values checked against Fastmail’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Fastmail
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
MX records for Fastmail
| Type | Name | Priority and host |
|---|---|---|
| MX | @ | 10 in1-smtp.messagingengine.com |
| MX | @ | 20 in2-smtp.messagingengine.com |
- Both records go on the root domain (@).
- Fastmail also offers regional MX servers for customers who want their data in a specific location; the page does not list those hosts, so ask Fastmail or check your account.
SPF for Fastmail
The mechanism to add is include:spf.messagingengine.com. A domain can publish only one SPF record, so you add it to the record that exists, you do not create a second one.
Fastmail is your only sender
v=spf1 include:spf.messagingengine.com ?allMerging into an existing record
Before
v=spf1 ip4:203.0.113.25 include:_spf.crm.example ~allAfter
v=spf1 ip4:203.0.113.25 include:spf.messagingengine.com include:_spf.crm.example ~allLookup budget
SPF allows 10 DNS-querying terms in total (RFC 7208), nested includes included. This include costs 1 DNS lookup (the include itself plus whatever it points to), measured by querying DNS on 2026-11-10. That leaves 9 for every other sender. Providers change their records, so re-measure with the SPF checker before you add the next one.
- This is the record Fastmail publishes. It ends in ?all, which means neutral: receivers learn that Fastmail may send but nothing is said about everyone else.
- Once every service that sends as your domain is in the record, move the ending to ~all or -all so SPF can fail unauthorised senders. Fastmail’s page does not give guidance on this; it is the usual next step.
- If other services also send as your domain, add their includes to this one record rather than publishing a second SPF record.
DKIM for Fastmail
Where: Your DNS host. Fastmail lists the three records in its manual DNS configuration page, with your domain in the target.
- Create three CNAME records: fm1._domainkey, fm2._domainkey and fm3._domainkey.
- Point each at fm1.<your-domain>.dkim.fmhosted.com, fm2.<your-domain>.dkim.fmhosted.com and fm3.<your-domain>.dkim.fmhosted.com, with your own domain filled in.
- Fastmail notes you need to add all three CNAME records.
| Type | Name | Value |
|---|---|---|
| CNAME | fm1._domainkey | fm1.<your-domain>.dkim.fmhosted.com |
| CNAME | fm2._domainkey | fm2.<your-domain>.dkim.fmhosted.com |
| CNAME | fm3._domainkey | fm3.<your-domain>.dkim.fmhosted.com |
Selector. Fastmail uses the fixed selectors fm1, fm2 and fm3.
- A deprecated mesmtp._domainkey record applies only to domains hosted at Fastmail before 2018. New setups do not use it.
DMARC with Fastmail
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- Fastmail publishes v=DMARC1; p=none; at _dmarc.<your-domain> and gives no further advice on the value.
- That record has no rua address, so you receive no reports. Add rua=mailto:<mailbox> before you rely on it, then follow the ramp-up below.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Common Fastmail mistakes
- Adding only fm1 and leaving out fm2 or fm3. Fastmail says to add all three.
- Leaving SPF at ?all forever. Neutral gives receivers nothing to act on.
- Using the pre-2018 mesmtp._domainkey record on a new domain.
- Forgetting to put your own domain inside the DKIM CNAME target (fm1.<your-domain>.dkim.fmhosted.com).
- Publishing p=none without rua. You get no reports and cannot tell when it is safe to enforce.
Fastmail email authentication FAQ
What are the MX records for Fastmail?
in1-smtp.messagingengine.com at priority 10 and in2-smtp.messagingengine.com at priority 20, both on the root domain.
What SPF record does Fastmail need?
Fastmail publishes v=spf1 include:spf.messagingengine.com ?all. Add other senders to the same record and consider tightening ?all to ~all or -all once they are all listed.
Which DKIM selectors does Fastmail use?
fm1, fm2 and fm3. Each is a CNAME at <selector>._domainkey that points to <selector>.<your-domain>.dkim.fmhosted.com.
Does Fastmail set up DMARC for me?
Its page lists a v=DMARC1; p=none; record at _dmarc. It has no reporting address, so add rua yourself and plan the move to quarantine and reject.
Can I have SPF records for both Fastmail and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Fastmail authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.