DNS overview for agency email

Every client launch hits DNS: without correct SPF, DKIM, and usually DMARC, inbox providers trust your mail less — and EonMailer may block sends until verification passes.

What DNS does for email

When you send hello@mail.client.com through SES, SendGrid, or Mailgun:

1. Receiving servers (Gmail, Outlook) look up DNS records for client.com / mail.client.com.
2. They check whether the sending server is authorized (SPF), whether the message is cryptographically signed (DKIM), and what to do if alignment fails (DMARC).
3. They score reputation based on history, content, and authentication results.

EonMailer surfaces the exact records your chosen provider requires — this article explains the moving parts so you can talk to client IT.

Who owns DNS?

Identify the DNS host early in onboarding:

Scenario	Who publishes records
Client uses Cloudflare	Client IT or agency with delegated access
Domain on GoDaddy, registrar DNS	Client approves ticket; agency pastes records
Route53 in client’s AWS	Agency DevOps with IAM route53 access
Agency holds domain for client	Agency publishes directly

Warning Campaign deadlines slip when nobody knows who can edit DNS. Get a named contact and login before build week.

Record types you’ll see

SPF (Sender Policy Framework)

TXT record listing which servers may send mail for the domain. Example shape:

v=spf1 include:amazonses.com ~all

Only one SPF TXT per hostname — merge multiple includes into a single record.

DKIM (DomainKeys Identified Mail)

Usually CNAME or TXT records publishing public keys. Provider signs each message; receivers verify signature.

DMARC

TXT at _dmarc.example.com telling receivers how to handle failures and where to send aggregate reports.

Verification TXT

Some providers add a one-time TXT to prove you control DNS before DKIM is issued.

MX (optional)

Only needed if you receive inbound mail at that subdomain (replies, inbound parsing).

Subdomain vs root domain strategy

Agencies commonly authenticate mail.client.com or email.client.com because:

• Root @ SPF may already include Google Workspace (include:_spf.google.com).
• Separating marketing sending protects corporate mail if marketing gets blocklisted.
• Easier rollback — delete subdomain records without touching workspace mail.

Align the From address domain with what’s authenticated.

Propagation timelines

Phase	Typical duration
DNS publish	Immediate at authoritative host
Global propagation	5 minutes – 4 hours common
Slow registrars	Up to 48 hours
EonMailer re-check	Polls every few minutes after you click Verify

Plan DNS work one week before first scheduled send.

Workflow with EonMailer

1. Connect provider in client workspace.
2. Add domain in EonMailer → copy records.
3. Publish at DNS host.
4. Wait for green checks in Verify a domain.
5. Complete Send-ready checklist.

Tools for validation

• dig TXT mail.client.com +short
• Google Admin Toolbox Dig
• MXToolbox SuperTool
• Provider-specific testers (SES, SendGrid, Mailgun dashboards)

When things go wrong

• Partial green — Often DKIM CNAME typo or Cloudflare proxy on wrong record.
• SPF permerror — Multiple SPF TXT on same host; merge them.
• DMARC none — OK for launch if intentional; move to quarantine/reject after stable sending.

Deep dive: SPF, DKIM, and DMARC explained.