Email sending is configured by our Technology department using dedicated transactional delivery providers tied directly to your custom domain. Production delivery requires explicit DNS authentication through SPF, DKIM, and DMARC to guarantee inbox placement and prevent spoofing.
Department responsibilities and access
The Technology department oversees all technical mail infrastructure, from provider setup to delivery monitoring. Creative produces the transactional templates, and Operations & Client Services manages the brief and coordinates domain ownership verification.
To set up sending domains, we require one of two routes for DNS access: 1. Direct access to your DNS provider (such as Cloudflare, AWS Route 53, or your domain registrar) via an invited team account with DNS edit permissions. 2. Delegated implementation, where we issue a precise DNS zone file or a table of required records to your internal IT team for manual insertion.
Direct access is the preferred route. It eliminates transcription errors and allows our engineers to verify and re-test records immediately within our working hours (Monday to Thursday, 09:00–17:00 GMT).
Required DNS records
Every transactional sending setup requires three standard authentication layers, alongside tracking subdomains where applicable:
* SPF (Sender Policy Framework): A TXT record defining which IP addresses or provider include-mechanisms may transmit mail on behalf of your domain. If an SPF record already exists, we merge our provider's mechanism into your current record. Domains must never have more than one SPF TXT record. * DKIM (DomainKeys Identified Mail): Public cryptographic keys published via CNAME or TXT records. These allow receiving mail servers to verify that the email originated from your domain and was not altered in transit. * DMARC (Domain-based Message Authentication, Reporting, and Conformance): A TXT record placed at `_dmarc.yourdomain.com` specifying how receiving mailboxes should handle mail failing SPF or DKIM. We mandate at least `p=none` for initial rollout, migrating to `p=quarantine` or `p=reject` once delivery consistency is proved. * Custom Return-Path / Mail-From: A dedicated CNAME record pointing a subdomain (such as `mail.yourdomain.com`) to the sending engine to ensure your domain matches the envelope sender.
Implementation sequence and timings
Configuration follows a structured five-step path:
1. Domain submission: You provide the sending domain during onboarding or through the Ask Xylo chat on this portal. 2. Record generation: The Technology department provisions the domain on our transactional mail infrastructure and generates the unique DNS keys. This takes place within 24 hours during working hours. 3. Record deployment: We apply the records directly or deliver the record table to your technical contact. 4. Propagation and validation: DNS propagation typically takes between 15 minutes and 24 hours. Our systems monitor the DNS status until all authentication checks return a verified state. 5. End-to-end test dispatch: We trigger test payloads to internal test suites across Google Workspace, Microsoft 365, and Apple Mail to inspect raw headers, TLS encryption, and DKIM signature passes.
Queries or manual record reviews submitted via the Ask Xylo chat receive an initial reply within 24 hours. For projects involving custom transactional messaging outside standard package scopes, bespoke quotes are issued within 48 hours of receiving a complete technical brief.
Failure cases and common issues
Delivery failures during launch almost always stem from DNS misconfigurations rather than the core application:
* Duplicate SPF strings: Adding a second TXT record beginning with `v=spf1` invalidates SPF entirely under RFC specifications. All mechanisms must exist within a single entry. * Cloudflare proxying (orange cloud): Pointing DKIM or Return-Path CNAME records through Cloudflare's HTTP proxy breaks resolution. All email-related CNAME records must be set to DNS-only (grey cloud). * Syntax and quotation errors: Copying TXT records through rich-text editors frequently introduces curly quotes or truncated key strings, breaking cryptographic validation. * Premature sending: Firing production transactional emails before global DNS caches update results in temporary bounces or junk-folder routing.
If authentication fails, our engineers pause sending pipelines immediately to protect the root domain's reputation until the records resolve.
Configuration checklist
* [ ] Target domain identified and verified under client ownership. * [ ] DNS management access granted or IT contact assigned. * [ ] Existing SPF record reviewed for merge requirements (maximum 10 DNS lookups maintained). * [ ] DKIM CNAME/TXT keys applied. * [ ] DMARC record created with valid operational reporting target. * [ ] Cloudflare or CDN proxying disabled on all mail-related subdomains. * [ ] Verification confirmation received from the Technology department via Ask Xylo chat.