Which DNS records do I need to add?

Publish exactly what the wizard prints. The base set is MX, SPF, DKIM, and DMARC. Newer domains also show an _amazonses TXT record plus mail.<domain> MX and SPF records so Amazon SES can verify the identity and align the outbound Return-Path. The DMARC record's rua points at a dmarc-rua@<your-domain> mailbox Folio manages for you; you do not add a separate _report._dmarc authorization record.

How long does verification take?

Most registrars publish DNS changes inside two to ten minutes. Right after you publish, the setup page checks every five seconds for five minutes, asking your domain's own nameservers so a cached answer can't hide a new record; after that it checks every thirty seconds while it's open. Folio keeps checking in the background after you close it, emails you once with what is live and what is still missing, and emails you again the moment the domain is live.

Can Folio add the records for me?

Often, yes. On Cloudflare, create an API token with the Edit zone DNS template for that one zone and paste it. On Route 53, a prefilled CloudFormation link creates a small role that can edit only that hosted zone and only Folio can use; paste its ARN, and delete the stack whenever you like. On GoDaddy, paste a production API key and secret — GoDaddy only opens its DNS API to some accounts, so the page falls back to the records if yours isn't one. Tokens and keys are used for that one request and never stored. If your host has enabled Folio's Domain Connect template, a Connect button opens your host's own approval screen instead. Everywhere else you can send the record set to whoever manages your DNS, or hand a ready-made brief to an AI assistant.

My domain already has email. Do I have to move it?

No. When Folio sees an existing mail provider on the domain, it starts in send-only mode: your current mailbox keeps receiving, Folio sends and signs from the same domain, and none of the records touch your domain's own MX. Once sending is live, the domain page offers to move incoming mail to Folio too, and Folio sends one reminder a week later. Nothing moves until you choose it.

What if my registrar adds the apex automatically?

Most registrars (Cloudflare, Namecheap, Route 53) let you enter the @ symbol or leave the name field blank for an apex record. The wizard shows the suffix-only form; your registrar appends your domain automatically.

Can I bind a subdomain instead of an apex?

Yes. Bind mail.studio.example the same way you bind studio.example — the records are scoped to whichever zone you point at our infrastructure.

Binding a domain

Binding a domain on Folio takes one guided screen at /app/domains/<your-domain>/setup. If the domain already receives mail at Google Workspace, Microsoft 365, Zoho or another provider, it starts in send-only mode: that mailbox keeps receiving and Folio only signs and sends, so there is no MX change. Where your DNS host allows it (Cloudflare with a scoped token, Route 53 with an access role you create, GoDaddy with an API key, or a host that has enabled Folio's Domain Connect template) the page publishes the records for you. Otherwise it links to your host's DNS editor, lets you send the records to whoever manages DNS, and checks each record live.

One guided screen: keep the mailbox you already have, let Folio publish the records where your DNS host allows it, or paste them by hand while the page checks itself.

Oct 2026· Updated 2026-10-06·8 min read

Every domain you add is a new identity — a new colour in the margin and a new From you can be reached at. Start at /app/domains/new, type the domain, and you land on its setup page. That one screen offers the fastest path your DNS host allows — Folio publishing the records for you on Cloudflare, Route 53 and GoDaddy, a Connect button where the host has enabled Folio’s Domain Connect template, and otherwise a direct link into its DNS editor plus a way to send the records to whoever manages it — and, underneath, every record as a copy-paste card with a live status.

§ Keeping the mailbox you have

If the domain already receives mail somewhere — Google Workspace, Microsoft 365, Zoho, your web host — Folio starts it in send-only mode. That mailbox keeps receiving exactly as it does today; Folio signs and sends from the domain, and the records it asks for leave the domain's own MX alone. The Receiving milestone says where your mail still lands instead of turning green.

When you're ready, the domain page offers to move incoming mail to Folio as well, with a week-later reminder by email. Until you choose it, nothing changes for anyone writing to you. A domain with no mail provider yet starts in full mode and receives in Folio from the first MX lookup.

§ The records

Publish the records the wizard prints at your registrar (Cloudflare, Route 53, Namecheap, whoever holds the zone). Names are written as suffixes; most registrars accept the leading @ or will append your apex automatically. New domains usually show seven records: four public mail records, one Amazon SES identity TXT, and two MAIL FROM records under mail. for Return-Path alignment. A send-only domain shows six: everything except the apex MX.

DNS · Example for the domain studio.example

TypeNameValue

MX · prio 10@inbound.wm.emcognito.com.

TXT@v=spf1 include:emcognito.com include:amazonses.com -all

TXTk3f9a2._domainkeyv=DKIM1; k=rsa; p=MIIBIjAN…

TXT_dmarcv=DMARC1; p=reject; sp=reject; adkim=s; aspf=r; rua=mailto:dmarc-rua@studio.example

Aside

The DMARC rua address points at dmarc-rua@<your-domain> — a receive-only mailbox Folio creates and manages for you on this domain. Aggregate reports land in your /app/deliverability view, not your inbox, and you don't create the alias yourself. No separate _report._dmarc authorization record is needed.

·MX tells the world that letters for your domain should arrive at our inbound server.
·SPF (that first TXT) declares which senders are allowed to write on your behalf.
·DKIM (the _domainkey TXT) publishes the public half of a signing key generated for this domain alone; outgoing letters are signed with the private half.
·DMARC (the _dmarc TXT) tells receivers what to do if a letter arrives unsigned — and sends aggregate reports to Folio for review.
·SES identity (the _amazonses TXT) proves to Amazon SES that you control the domain.
·MAIL FROM (the mail. MX and SPF pair) aligns the outbound Return-Path with your domain instead of a shared carrier domain.

§ Verification

The setup page checks the records on its own while it is open and shows two milestones: Receiving turns green the moment the MX resolves (mail to the domain lands in Folio from then on), and Sending turns green when all of them do. Right after you publish, the page checks every five seconds for five minutes, straight against the domain's own nameservers. You do not need to wait on the page — background verification revisits pending domains, emails you once with what is live and what is still missing, and emails you again when the domain is live. Most zones resolve in under ten minutes; Cloudflare, in our experience, is closer to two.

Aside

A domain can sit at pending for up to forty-eight hours without issue. Only at that point do we stop polling and ask you to check the records manually.

§ Sending enabled

Once the DNS, SES identity, and MAIL FROM gates are green, a final green badge appears on the domain: sending enabled. From that moment forward, any reply to a letter that arrived at *@studio.example will be sent from that domain, DKIM-signed in its own key.

If you only want to receive on a domain and never send, inbound routing can work before the outbound carrier gates finish. The UI keeps that distinction visible instead of pretending the domain is fully send-ready early.

§ Common questions

Which DNS records do I need to add?: Publish exactly what the wizard prints. The base set is MX, SPF, DKIM, and DMARC. Newer domains also show an _amazonses TXT record plus mail.<domain> MX and SPF records so Amazon SES can verify the identity and align the outbound Return-Path. The DMARC record's rua points at a dmarc-rua@<your-domain> mailbox Folio manages for you; you do not add a separate _report._dmarc authorization record.
How long does verification take?: Most registrars publish DNS changes inside two to ten minutes. Right after you publish, the setup page checks every five seconds for five minutes, asking your domain's own nameservers so a cached answer can't hide a new record; after that it checks every thirty seconds while it's open. Folio keeps checking in the background after you close it, emails you once with what is live and what is still missing, and emails you again the moment the domain is live.
Can Folio add the records for me?: Often, yes. On Cloudflare, create an API token with the Edit zone DNS template for that one zone and paste it. On Route 53, a prefilled CloudFormation link creates a small role that can edit only that hosted zone and only Folio can use; paste its ARN, and delete the stack whenever you like. On GoDaddy, paste a production API key and secret — GoDaddy only opens its DNS API to some accounts, so the page falls back to the records if yours isn't one. Tokens and keys are used for that one request and never stored. If your host has enabled Folio's Domain Connect template, a Connect button opens your host's own approval screen instead. Everywhere else you can send the record set to whoever manages your DNS, or hand a ready-made brief to an AI assistant.
My domain already has email. Do I have to move it?: No. When Folio sees an existing mail provider on the domain, it starts in send-only mode: your current mailbox keeps receiving, Folio sends and signs from the same domain, and none of the records touch your domain's own MX. Once sending is live, the domain page offers to move incoming mail to Folio too, and Folio sends one reminder a week later. Nothing moves until you choose it.
What if my registrar adds the apex automatically?: Most registrars (Cloudflare, Namecheap, Route 53) let you enter the @ symbol or leave the name field blank for an apex record. The wizard shows the suffix-only form; your registrar appends your domain automatically.
Can I bind a subdomain instead of an apex?: Yes. Bind mail.studio.example the same way you bind studio.example — the records are scoped to whichever zone you point at our infrastructure.