Fastmail Email Authentication Setup

Privacy-focused email hosting service with custom domain support. This guide covers the complete email authentication stack for Fastmail: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.

Jump to a Protocol

SPF

Authorize which servers can send email for your domain.

DKIM

Cryptographically sign your outgoing email so receivers can verify it.

DMARC

Tell receivers what to do when SPF or DKIM fail.

SPFTest with our SPF Checker →

How to Set Up SPF for Fastmail

Authorize Fastmail to send email on behalf of your custom domain by adding the correct SPF include.

Quick Answer — The Record You Need

Type

TXT

Host / Name

Value

v=spf1 include:spf.messagingengine.com ~all

Fastmail's parent company is Messaging Engine. The SPF include uses their infrastructure domain.

Step-by-Step Setup

Log in to Fastmail

Go to fastmail.com and sign in to your account.

Navigate to domain settings

Go to Settings > Domains. Select your custom domain.

View required DNS records

Fastmail displays all required DNS records including SPF, DKIM, and MX.

Add the SPF record

Add a TXT record with the SPF include for Fastmail.

v=spf1 include:spf.messagingengine.com ~all

Verify in Fastmail

Fastmail will check your DNS records and show verification status.

Before & After

Before

v=spf1 ~all

After

v=spf1 include:spf.messagingengine.com ~all

SPF Gotchas

Fastmail uses spf.messagingengine.com, not spf.fastmail.com. Messaging Engine is Fastmail's parent company.
If you also use Fastmail for sending from aliases, all aliases use the same SPF include.
Fastmail provides a complete set of DNS records (MX, SPF, DKIM, DMARC). Set them all up together for best results.

SPF FAQ

What SPF record do I need for Fastmail?

Add include:spf.messagingengine.com to your SPF record. This is Fastmail's sending infrastructure domain.

Why does Fastmail use messagingengine.com for SPF?

Messaging Engine Pty Ltd is Fastmail's parent company. Their email infrastructure runs under the messagingengine.com domain.

Do I also need MX records for Fastmail?

Yes. Fastmail requires MX records pointing to in1-smtp.messagingengine.com and in2-smtp.messagingengine.com for receiving email.

DKIMTest with our DKIM Checker →

How to Set Up DKIM for Fastmail

Enable DKIM for Fastmail by publishing three CNAME records for the fm1, fm2, and fm3 selectors.

Quick Answer — The Record You Need

Type

CNAME

Host / Name

fm1._domainkey

Value

fm1.yourdomain.com.dkim.fmhosted.com

Fastmail uses three DKIM selectors: fm1, fm2, and fm3. All three CNAME records must be added.

Step-by-Step Setup

Log in to Fastmail

Go to fastmail.com and sign in.

Navigate to domain settings

Go to Settings > Domains. Select your custom domain.

View the DKIM records

Fastmail displays three CNAME records for DKIM with selectors fm1, fm2, and fm3.

Add all three CNAME records

Create the three CNAME records in your DNS provider.

fm1._domainkey.yourdomain.com  CNAME  fm1.yourdomain.com.dkim.fmhosted.com
fm2._domainkey.yourdomain.com  CNAME  fm2.yourdomain.com.dkim.fmhosted.com
fm3._domainkey.yourdomain.com  CNAME  fm3.yourdomain.com.dkim.fmhosted.com

Verify in Fastmail

Fastmail will verify the DKIM records and activate signing.

DKIM Gotchas

Fastmail requires all three CNAME records (fm1, fm2, fm3). This allows key rotation without downtime.
The CNAME values include your domain name in the target: fm1.yourdomain.com.dkim.fmhosted.com. Replace yourdomain.com with your actual domain.
If you manage DNS through Fastmail directly (using their nameservers), DKIM is configured automatically.

DKIM FAQ

What DKIM selectors does Fastmail use?

Fastmail uses fm1, fm2, and fm3 as DKIM selectors. All three are published as CNAME records pointing to fmhosted.com.

Why does Fastmail use three DKIM selectors?

Three selectors allow Fastmail to rotate DKIM keys smoothly. One selector is active while others are prepared for rotation.

Can Fastmail manage my DNS and DKIM automatically?

Yes. If you use Fastmail's nameservers for your domain, DKIM (and all other records) are configured automatically.

DMARCTest with our DMARC Checker →

How to Set Up DMARC for Fastmail

Publish a DMARC record to protect your custom domain when using Fastmail for email.

Quick Answer — The Record You Need

Type

TXT

Host / Name

_dmarc

Value

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Fastmail provides SPF and DKIM alignment by default when properly configured.

Step-by-Step Setup

Configure SPF and DKIM

Set up SPF (include:spf.messagingengine.com) and DKIM (fm1/fm2/fm3 CNAMEs) for Fastmail.

Test email authentication

Send a test email from Fastmail and verify SPF and DKIM pass in the headers.

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Monitor reports

Review DMARC aggregate reports. Fastmail typically has clean alignment.

Enforce the policy

Fastmail provides good alignment. After confirming, move to p=quarantine and then p=reject.

DMARC Gotchas

Fastmail provides both SPF and DKIM alignment, making it well-suited for strict DMARC policies.
If you use Fastmail as your only email sender, you can move to p=reject relatively quickly after monitoring.
If you use Fastmail with other services (mailing lists, marketing tools), ensure all are authenticated first.

DMARC FAQ

Does Fastmail support DMARC alignment?

Yes. Fastmail provides both SPF and DKIM alignment when properly configured with a custom domain.

Can I use p=reject with Fastmail?

Yes. Fastmail has excellent authentication support. If Fastmail is your only sender, you can safely use p=reject.

Does Fastmail manage DMARC automatically?

If you use Fastmail's nameservers, they can set up the DMARC record for you. Otherwise, add it manually to your DNS.

Verify Your Fastmail Setup

Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.

Setup Guides for Other Providers

Google Workspace Microsoft 365 SendGrid Mailchimp Mailgun Amazon SES Postmark HubSpot Zendesk Zoho Mail Salesforce Brevo All Guides →