1. Records You Need to Add
Add an MX record so mail routes to Humerly, then configure SPF, DKIM, DMARC, and MTA-STS for authentication and encrypted delivery to your domain.
| Type | Host / Name | Value |
|---|---|---|
| MX | @ (root domain) | 10 mail.humerly.com |
| TXT (SPF) | @ | v=spf1 include:_spf.humerly.com -all |
| TXT (DKIM) | humerly._domainkey | Auto-generated after DNS verification — check your dashboard |
| TXT (DMARC) | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected]; pct=100 |
| TXT (MTA-STS) | _mta-sts | v=STSv1; id=20260424120000 |
Note: Change the MTA-STS id value whenever you update the policy file below (any unique timestamp-style string is fine).
Copy-paste values: Click any value below to copy it.
Shown in your dashboard after you verify the records above.
Start at p=none (monitoring). Point rua at a mailbox on YOUR OWN domain so reports reach you. Move to p=quarantine after your first clean reporting period.
Announces your TLS policy. Must pair with the HTTPS policy file in the next card.
Host this exact file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt (replace yourdomain.com) over HTTPS with a valid certificate. Add an A or CNAME for the hostname mta-sts pointing to wherever you serve the file (Cloudflare, your VPS, etc.).
2. Step-by-Step Instructions
Select your DNS provider for specific instructions:
- 1 Log in to dash.cloudflare.com
- 2 Select your domain from the dashboard
- 3 Go to DNS → Records
- 4 Click Add Record
- 5 For each record: select the type, enter the name/host, paste the value
- 6 Set TTL to Auto and click Save
- 7 For MX records: set Priority to 10
- 8 For MTA-STS: add the
_mta-stsTXT record, then publish the policy file under themta-stshostname (see cards above). Use a Cloudflare Worker or full (not flexible) SSL on themta-stssubdomain so HTTPS validates.
Tip: Make sure the orange proxy cloud is OFF (gray/DNS only) for MX records.
- 1 Log in to godaddy.com → My Products
- 2 Find your domain and click DNS
- 3 Click Add under DNS Records
- 4 Select the record type, enter @ as host for root records
- 5 Paste the value from above
- 6 Click Save
- 1 Log in to namecheap.com → Domain List → Manage
- 2 Go to the Advanced DNS tab
- 3 Click Add New Record
- 4 Select type, enter @ as host, paste value
- 5 Click the green checkmark to save
The process is similar for all DNS providers. Look for DNS Management or DNS Records in your domain settings.
For each record:
- Select the record type (MX or TXT)
- Enter the host/name (
@for root, or the specific subdomain) - Paste the value from the table above
- Save
Stuck? Reply to your setup email or WhatsApp us at +91-99669-33323.
3. Verify Your Setup
After adding all records, go to your Humerly Dashboard and click Verify DNS. We'll automatically check that everything is configured correctly.
DNS changes typically propagate within 5–30 minutes, but can take up to 48 hours in rare cases.
Go to Dashboard →4. Troubleshooting
You can only have one SPF record per domain. Merge them by adding include:_spf.humerly.com to your existing SPF record and ending it with -all (our verification requires the strict -all).
Some providers split long TXT records automatically. Paste the full value and let the provider handle splitting. This is normal behavior.
DNS propagation takes up to 48 hours, but usually completes in 5–30 minutes. Click Verify DNS again after waiting.
Add our MX record (10 mail.humerly.com) alongside your existing MX records. Set it to priority 10 (or higher number = lower priority than your primary). Your existing email will continue working normally.
The TXT record alone is not enough: sending servers fetch https://mta-sts.yourdomain/.well-known/mta-sts.txt. The file must be reachable over HTTPS with a certificate that matches mta-sts.yourdomain. After any policy change, update the id= in the _mta-sts TXT record.
Reply to your setup email or WhatsApp us at +91-99669-33323. We'll help you configure everything.
5. BIMI (Brand Indicators for Message Identification)
BIMI lets qualifying mailbox providers show your logo next to the message in the inbox when authentication passes. It is optional, but it is one of the strongest visible trust signals for B2B brands.
What it is and why teams want it
BIMI builds on strict DMARC (p=quarantine or p=reject) and a valid indicator: either a VMC (Verified Mark Certificate) from a participating CA, or (where supported) a CMC (Common Mark Certificate) path. Without DMARC enforcement and aligned SPF/DKIM, BIMI will not display.
DNS records (typical layout)
- DMARC at enforcement on
_dmarc(BIMI requires alignment;p=noneis not enough for most providers). - SVG logo hosted at a stable HTTPS URL you control (simplified SVG profile per BIMI group spec).
- BIMI TXT on
default._bimipointing at your logo URL and, when using VMC, referencing the certificate.
| Type | Host / Name | Value (example pattern) |
|---|---|---|
| TXT | default._bimi | v=BIMI1; l=https://cdn.yourdomain.com/brand/logo-bimi.svg; a=https://cdn.yourdomain.com/brand/vmc.pem |
Replace URLs with your CDN or marketing host. The a= PEM is used with VMC; some stacks omit a= when using a CMC-based workflow where the mailbox provider supplies trust — confirm current provider docs before publishing.
VMC vs CMC (plain language)
VMC — You buy a verified mark certificate from a CA that participates in the BIMI ecosystem. This is the path most enterprises use for Gmail and other major providers that require a mark certificate.
CMC — A common-mark approach tied to broader trust frameworks; availability depends on CA and mailbox-provider support. Treat it as “ask your CA + legal + each target provider” before relying on it in production.
Cost planning
VMC pricing is CA-dependent and often around USD 1,200–1,800 per year all-in (certificate + mark verification), plus legal/trademark prerequisites. Budget time for trademark paperwork, not only DNS.
6. DMARC report aggregation and how to read them
DMARC XML reports (rua= aggregate mail) tell you who sent mail using your domain, whether SPF and DKIM aligned, and what action the receiver applied.
What to look for first
- Pass rate vs fail rate — A sudden spike in
failfor your known ESP sources means misalignment (wrong envelope-from, broken DKIM selector, or forwarding stripping signatures). - Unknown sources — New
org_name/header_fromrows you do not recognize may be phishing or a shadow IT tool. - Policy mode — If you are still on
p=none, use reports to tighten SPF/DKIM before moving toquarantinethenreject.
Recommended tools
Free human-readable digests from aggregate reports; good for operators who do not want to parse raw XML daily.
Useful domain-level visibility and trending; upgrade paths exist if you need workflow and enforcement automation later.
Whichever tool you pick, export samples before major DNS changes so you can compare before/after pass percentages for the same sending IPs.
7. Provider reputation hubs (subdomain strategy)
Beyond SPF/DKIM/DMARC, the large mailbox providers expose sender-facing dashboards tied to your domain or IP reputation. You do not replace DMARC with these — you complement it.
Google: Postmaster Tools
- Create or use a Google account with access to your production domain.
- Visit postmaster.google.com and add your domain.
- Add the supplied TXT token at the host they specify (often root or a Google-provided subdomain).
- After verification, monitor IP/domain reputation, spam rate, and authentication graphs — especially after IP or ESP changes.
Microsoft: Smart Network Data Services (SNDS)
For dedicated IPs or high-volume Microsoft delivery, enroll IPs in SNDS. You will see color-coded status (green/yellow/red) and complaint signals that do not always surface in DMARC alone.
Yahoo / Verizon Media: Complaint Feedback Loop (CFL)
Enroll eligible IPs/domains in Yahoo’s CFL so abuse complaints return as ARF feedback messages. Setup is account- and IP-specific; coordinate with your ESP if you send through a shared pool.
Tip: Keep Postmaster/SNDS/CFL out of customer SPF includes. They are verification and telemetry channels, not mail-sending services.
8. Common DNS mistakes that break deliverability
DNS TXT strings are limited (commonly 255 characters per string in the wire format). Long DKIM keys and SPFs must be split into multiple quoted strings on one TXT row. If your panel “truncates” silently, DKIM fails intermittently.
SPF evaluation allows at most 10 mechanisms that trigger DNS lookups (include, a, mx, redirect, etc.). Exceeding the limit makes SPF permerror — treated as a fail by many receivers. Flatten includes or remove unused vendors.
2048-bit RSA is the modern default for new keys. Some older panels struggle with the longer TXT; use multi-string TXT if needed. 1024-bit keys still work in places but are weaker over time — plan rotation to 2048 on your next key change.
Exactly one SPF TXT record is allowed per aligned hostname. If marketing adds a second SPF at @, receivers may ignore both or merge unpredictably. Merge into a single record.