Reputation Builder

DNS setup for Inbox Boost

SenderSignal assigns the authentication records and can publish them into your zone for you. This page covers both paths: the connected-registrar flow, and the exact records to add by hand on a registrar we do not support yet.

Why DNS setup comes first

Inbox Boost sends real Inbox Boost mail from infrastructure dedicated to your domain. Receiving providers must see valid SPF, DKIM, and aligned return-path. Without them, mail bounces or lands in spam. DNS setup walks you through publishing exactly the records needed for your domain, then confirms they are live at public resolvers before Inbox Boost unlocks.

Where to start

  1. Open Reputation Builder → DNS Setup in the sidebar.
  2. Add a domain that is already monitored under Monitor (or register a new monitored domain first).
  3. Open the domain detail page: you will see a step-by-step wizard: Domain added → Publish DNS → Verify records → Inbox Boost ready.

Records you will publish

SenderSignal generates domain-specific values. Copy each record into your DNS registrar or DNS provider (Cloudflare, Route 53, GoDaddy, etc.). Typical records include:

SPF (TXT at root / apex)

  • Authorizes which servers may send mail for your domain
  • If you already have SPF, SenderSignal shows a merged value: your existing includes plus the dedicated sending include assigned to your domain
  • Only one SPF TXT record should exist at the apex; replace or merge rather than adding a duplicate

DKIM (TXT on selector subdomain)

  • Public key for signing outbound mail (e.g. selector._domainkey.yourdomain.com)
  • Host name and full TXT value are shown on the setup page: copy both exactly
  • The value is long, and it is the one record most often saved incorrectly. Use the copy button rather than selecting the text by hand
Two things to check after saving DKIM. First, that the whole value was stored: some registrars silently cut long TXT values short. Second, that nothing was added to the end of it, such as a stray quote or backtick picked up while copying. The value must finish at the final semicolon. Either problem makes receiving servers reject the record, and your mail is then sent without a valid signature. SenderSignal checks the whole value and tells you which of the two it found.

If your DNS provider rejects the DKIM value as too long

A single DNS text string cannot exceed 255 characters, and every DKIM key is longer than that. Providers such as Route 53 reject the whole key with an error like CharacterStringTooLong.

The answer is one record holding the value in quoted parts:

"v=DKIM1; h=sha256; ...first part" "...second part;"

Both parts go in the same value field on the same record, each in its own quotes, separated by a space. Do not create a second record for the remainder: two records at one DKIM name is invalid and receiving servers reject the pair.

Return-path (CNAME)

  • Custom bounce/return-path domain (e.g. rp.yourdomain.com) pointing to your assigned return-path hostname
  • Improves alignment between envelope sender and your brand domain

Domain ownership (TXT, when required)

  • Some domains require a one-time ownership TXT record before SPF/DKIM values are issued
  • After ownership verifies, remaining records appear automatically

DMARC (TXT at _dmarc, recommended)

  • Policy telling receivers what to do with mail that fails SPF/DKIM alignment
  • If you already publish DMARC, the page shows your live policy and may suggest tightening p=none to quarantine or reject
  • If DMARC is missing, a recommended starter record is provided

Custom MAIL FROM / MX (when shown)

Depending on your configuration, additional MX or MAIL FROM guidance may appear. Follow the on-page instructions: they are tailored to your domain.

Tracking domain (optional)

Opens and clicks in Inbox Boost mail are recorded through a link. By default that link uses a SenderSignal address, which is shared with every other sender on the platform. A tracking domain moves those links onto your own domain instead, so the address a recipient sees belongs to you.

It is optional. Inbox Boost runs either way, and opens and clicks are recorded either way. Only the address inside the link changes.

Turning it on

  1. Open DNS Setup for the domain and select Tracking from the record list.
  2. Switch on Enable custom tracking domain.
  3. Leave the suggested Tracking subdomain or type your own, for example go, link or email. The domain it is added to is shown beside the field.
  4. Save. The CNAME record to publish appears underneath.

Publishing the record

Add the CNAME exactly as shown, using the Host and Points to values on the card. It is a CNAME, not a TXT record.

If your DNS is on Cloudflare, leave the record proxied (the orange cloud). Cloudflare then provides the certificate for your tracking address. With the proxy off, or on a DNS provider that does not proxy traffic, browsers may warn about the certificate when a link is opened.

Why the suggested name sits where it does

The suggested subdomain is always one level below your registrable domain. If you send from a subdomain such as alerts.yourdomain.com, the suggestion is trck-alerts.yourdomain.com rather than trck.alerts.yourdomain.com. Wildcard certificates cover one level only, so the shorter form is the one your existing certificate already covers. You can change the label, but keeping it one level below avoids a certificate that does not match.

Verifying it

  1. Publish the CNAME at your DNS provider.
  2. Return to the Tracking card and click Verify.
  3. The card shows Verified with the date once the record is found.

Cloudflare hides a proxied CNAME from public DNS lookups, so for proxied records SenderSignal confirms the address over HTTPS instead. Either route results in the same Verified state.

Until it verifies, links keep using the SenderSignal address. Nothing stops and no data is lost, so you can set this up before or after starting Inbox Boost.

Publishing at your registrar

  1. Copy Host / Name and Value from each record card
  2. Paste into your DNS provider: use TXT for SPF/DKIM/DMARC, CNAME for return-path
  3. Save changes and wait for propagation (often minutes; can take up to 24-48 hours globally)
  4. Return to SenderSignal and click Verify DNS records
DNS propagation is not instant. If verification fails immediately after publishing, wait a few minutes and verify again. SenderSignal queries multiple public resolvers to confirm records are visible.

Verification statuses

StatusMeaning
VerifiedRecord found at DNS and matches expected value
PendingNot found yet or still propagating: verify again later
AdvisoryRecord exists but could be improved (e.g. weak DMARC policy)
FailedMissing or wrong value: compare registrar entry with expected value

After verification

When SPF and DKIM verify, SenderSignal provisions your dedicated sending configuration in the background. The wizard advances to Inbox Boost ready. You can then configure Inbox Boost template and From address under Inbox Boost before starting volume ramp.

Common issues

  • Duplicate SPF: merge into one TXT record; delete extras
  • Wrong DKIM host: some registrars append the apex automatically; enter only the selector portion if instructed
  • Incomplete DKIM value: the key was cut short when it was saved. The setup page reports how many characters are published against how many it expects. Copy the value again and confirm the whole key was stored
  • Extra characters after the DKIM value: a quote, space or stray symbol picked up while copying. The value must end at the final semicolon. The setup page names the character it found
  • Tracking domain will not verify: check it is a CNAME rather than a TXT record, and that the name is one level below your registrable domain. On Cloudflare, leave the record proxied
  • CNAME conflict: return-path host cannot coexist with other record types on the same name
  • SPF lookup limit: too many include: mechanisms; SenderSignal warns when merge would exceed DNS lookup limits

Relationship to Monitor deliverability

Monitor → Deliverability checks SPF/DKIM/DMARC independently. DNS Setup records are optimized for sending through Inbox Boost. Keep both aligned: after publishing here, rescan deliverability on the same domain to confirm external probes agree.

Start Inbox Boost → · Deliverability checks →