Set these BEFORE the first install so Let's Encrypt and DKIM succeed on first run.
| Record | Example | Purpose |
|---|---|---|
| A / AAAA | mail.example.com → 198.51.100.10 |
Hostname for UI, SMTP, IMAP |
| PTR (rDNS) | 198.51.100.10 → mail.example.com |
Required by Gmail/M365 |
| MX | example.com MX 10 mail.example.com |
Inbound routing |
| SPF | v=spf1 mx ~all (initially) |
Authorize Mailcow's IP |
| DKIM | TXT at dkim._domainkey.example.com |
Added after Mailcow generates the key |
| DMARC | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
Reports first, enforce later |
| MTA-STS | _mta-sts.example.com TXT + policy file |
Modern TLS enforcement |
| TLS-RPT | _smtp._tls.example.com TXT |
TLS failure reports |
| Autodiscover | autodiscover.example.com CNAME mail.example.com |
Outlook auto-config |
| Autoconfig | autoconfig.example.com CNAME mail.example.com |
Thunderbird auto-config |
⚠️ PTR is non-negotiable. Gmail and Microsoft 365 both reject mail from IPs without matching forward+reverse DNS. Most VPS providers set this in their control panel, not your DNS host.
Sign in to keep track of what you have read.