Understanding Fastmail (Custom Domains) Email Authentication
Fastmail is an independent, privacy-centric email suite supporting custom domains with triple CNAME-based automated DKIM key rotation and SPF authorization via messagingengine.com.
When Fastmail (Custom Domains) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Fastmail (Custom Domains)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Fastmail
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:spf.messagingengine.com ~all | 3600 | Fastmail SPF authorization. |
| CNAME | fm1._domainkey | fm1.yourdomain.com.dkim.fmhosted.com | 3600 | Fastmail rotating DKIM 1. |
| MX | @ | in1-smtp.messagingengine.com | 3600 | Primary Fastmail MX. |
Step-by-Step Setup Instructions
In Fastmail > Settings > Domains > Add Custom Domain.
Add the SPF TXT record: "v=spf1 include:spf.messagingengine.com ~all".
Add the 3 DKIM CNAME records (fm1._domainkey, fm2._domainkey, fm3._domainkey) pointing to messagingengine.com.
Add Fastmail MX records: in1-smtp.messagingengine.com (Priority 10) and in2-smtp.messagingengine.com (Priority 20).
Verify domain in Fastmail Settings.
Common Fastmail SPF Configuration Mistakes
× DKIM CNAME Trailing Dot Error
Cause: Omitting or adding extra periods in DNS provider CNAME targets.
Fix: Verify DNS provider syntax requirements.
Frequently Asked Questions
What is the SPF include mechanism for Fastmail?
Fastmail uses "include:spf.messagingengine.com".