Sending Email From Your Own Domain

Requires.

• A Yes grant for SecurityTrax Global Settings to set your sending address in SecurityTrax.
• Access to edit your domain's DNS records (usually handled by whoever manages your domain — your IT team or domain registrar account).

SecurityTrax can send email that appears to come from your own domain — for example invoicing@acme.com instead of a generic SecurityTrax address. To keep that mail out of recipients' spam folders, major email providers (Gmail, Yahoo, Outlook, and others) require you to prove that SecurityTrax is authorized to send on your domain's behalf. You do that by adding a few DNS records to your domain.

This page walks you through all four records and how to verify them. Once you finish, let SecurityTrax know so we can turn on signed sending for your account.

How it works

Three standards work together to authenticate your email. You'll set up all three:

Throughout this page, replace acme.com with the domain you actually send mail from (the part after the @ in your sending address, e.g. acme.com for invoicing@acme.com).

Where your sending address is set in SecurityTrax

Your outgoing "from" address lives in Administration → Global Settings → Email Settings (see Advanced Admin). The relevant fields are Email From Address (used for campaigns and automated mail) and Corporate Email From Address. The domain in those addresses is the domain you'll authenticate below.

Before you begin

If you're comfortable editing DNS records, skip to Step 1 — each step below is a copy-paste record spec. If DNS is new to you, this section gets you oriented.

Where this happens. You'll make these changes wherever your domain's DNS is managed — usually the company you bought your domain from (for example GoDaddy, Namecheap, Cloudflare, Google Domains, Squarespace, or Wix). Log in there and look for a section called DNS, DNS Management, DNS Records, or Advanced DNS. None of this happens inside SecurityTrax.

What "adding a record" means. On that screen you'll add each record by choosing a record type (such as TXT or CNAME) and filling in two main fields:

• Host — where the record lives on your domain. Some providers label this Name or Hostname. To target your root domain (acme.com), many providers want you to enter @ instead of typing the domain again.
• Value — what the record says. Some providers label this Points to, Content, or Target.

A few things to put you at ease:

• Adding these records is safe — they authenticate email and won't take your website or existing email offline.
• Plan about 15 minutes to enter everything, plus waiting time for the changes to spread across the internet (see Step 4).
• If any of this feels unfamiliar, hand this page to whoever manages your domain or set up your company email — they'll recognize every step.

Set a low TTL first. TTL ("time to live") controls how long the internet caches a record. Set it to 300 seconds (5 minutes) on the records you add or edit, so any correction takes effect quickly instead of being stuck for hours.

Step 1 — Configure SPF

SPF records are stored as a DNS TXT record on your domain. You need SecurityTrax's sending infrastructure included in your SPF record by adding the text include:spf.alarm.com.

If you do not already have an SPF record, create a new TXT record:

If you already have an SPF record, edit the existing one and add include:spf.alarm.com (surrounded by spaces) before the closing all term. For example, an existing record becomes:

v=spf1 include:spf.alarm.com include:_spf.google.com ~all

Warning. A domain must have exactly one SPF record. Creating a second SPF TXT record breaks email authentication for your whole domain. If a record starting with v=spf1 already exists, edit that one — never add another.

Heads up. SPF records are limited to 10 DNS lookups total. Each include: counts toward that limit. If your domain already has several include: entries (from other mail tools), adding one more could push you over the limit and cause SPF to fail. If you're already close, contact your other providers about consolidating, or reach out to your SecurityTrax account manager.

Step 2 — Configure DKIM

DKIM uses two DNS CNAME records that point at public keys SecurityTrax hosts. A CNAME record creates an alias from one name to another.

Create both of these records, replacing acme.com with your domain:

Heads up. Many DNS providers automatically append your domain to whatever you type in the Host / Name field. If yours does, enter only the part before your domain — for example 20240311140222securitytrax._domainkey instead of the full 20240311140222securitytrax._domainkey.acme.com. Entering the full value in a provider that auto-appends produces a broken host like ..._domainkey.acme.com.acme.com. This is the single most common DKIM setup mistake — double-check the final host name after saving.

Note. If your SecurityTrax account manager gave you different DKIM record values than the ones above, use the values they provided. The selectors above are SecurityTrax's current published keys.

Step 3 — Configure DMARC

DMARC is stored as a DNS TXT record and tells receiving mail servers what to do with mail from your domain that fails SPF or DKIM.

If you already have a DMARC record, leave it as is — no change is needed. If you don't have one, create this TXT record:

The p=none policy is monitoring-only: it asks receivers to still deliver mail that fails checks while you confirm everything is working. It's the safest starting point. You can tighten the policy later once you've verified your mail authenticates reliably.

Step 4 — Verify your records

DNS changes can take anywhere from a few minutes to 48 hours to fully propagate. Once they've had time to spread, confirm each record with a free lookup tool such as MxToolbox:

If a lookup comes back empty, give DNS more time to propagate, then re-check. If it's still missing after a day, revisit the record for typos — especially the host name (Step 2's auto-append gotcha) and a stray second SPF record (Step 1).

Step 5 — Tell SecurityTrax

Once all four lookups pass, reply to your SecurityTrax account manager or contact SecurityTrax support to let us know you've finished. There's a final step SecurityTrax completes on our end to enable signed sending from your domain — we do that only after your DNS records are verified. Until you notify us and we enable it, your mail may still send from the default address.

Common mistakes

• Two SPF records. Only one v=spf1 TXT record is allowed per domain. Merge everything into a single record.
• Full host name in an auto-appending DNS provider. For the DKIM CNAMEs, if your provider adds your domain automatically, enter only the portion before your domain.
• Editing an existing DMARC record you didn't need to touch. If a DMARC record already exists, leave it alone.
• Checking too soon. DNS can take up to 48 hours to propagate. An empty lookup right after saving usually just means it hasn't spread yet.
• Multiple sending domains. If you send from more than one domain, repeat all of these records for each domain — SPF, DKIM, and DMARC are per-domain.

Related

• Advanced Admin — set your Email From Address and Corporate Email From Address in Global Settings → Email Settings.
• Email Campaigns — bulk marketing emails that also send from your authenticated address.
• Messages — transactional emails sent to individual customers.