Which DNS records do I need to add?

Publish exactly what the wizard prints. The base set is MX, SPF, DKIM, and DMARC. Newer domains also show an _amazonses TXT record plus mail.<domain> MX and SPF records so Amazon SES can verify the identity and align the outbound Return-Path. The DMARC record's rua points at a dmarc-rua@<your-domain> mailbox Folio manages for you; you do not add a separate _report._dmarc authorization record.

How long does verification take?

Most registrars publish DNS changes inside two to ten minutes. The setup page checks on its own every thirty seconds while it's open, and Folio keeps checking in the background after you close it — you get an email the moment the domain is live.

Can Folio add the records for me?

Often, yes. If your DNS is at Cloudflare, create an API token with the Edit zone DNS template for that one zone, paste it on the setup page, and Folio writes all seven records and reports what it did; the token is used once and never stored. If your host supports Domain Connect (GoDaddy, IONOS, Squarespace Domains and others), a Connect button opens your host's own approval screen. Otherwise you can email the record set to whoever manages your DNS, or hand a ready-made brief to an AI assistant.

What if my registrar adds the apex automatically?

Most registrars (Cloudflare, Namecheap, Route 53) let you enter the @ symbol or leave the name field blank for an apex record. The wizard shows the suffix-only form; your registrar appends your domain automatically.

Can I bind a subdomain instead of an apex?

Yes. Bind mail.studio.example the same way you bind studio.example — the records are scoped to whichever zone you point at our infrastructure.

Binding a domain

Binding a domain on Folio takes one guided screen at /app/domains/<your-domain>/setup. Where your DNS host supports it (Cloudflare with a scoped API token today; Domain Connect hosts such as GoDaddy and IONOS as they enable Folio's template) the page publishes the seven records for you. Otherwise it links to your host's DNS editor, lets you email the records to whoever edits DNS, and checks each record live — receiving goes live the moment the MX resolves; sending unlocks when all seven do.

One guided screen: let your DNS host publish the records in a click where it can, or paste them by hand while the page checks itself.

Sep 2026· Updated 2026-09-06·7 min read

Every domain you add is a new identity — a new colour in the margin and a new From you can be reached at. Start at /app/domains/new, type the domain, and you land on its setup page. That one screen offers the fastest path your DNS host allows — a one-click connect where the host supports it, a direct link into its DNS editor where it doesn't — and, underneath, every record as a copy-paste card with a live status.

§ The records

Publish the records the wizard prints at your registrar (Cloudflare, Route 53, Namecheap, whoever holds the zone). Names are written as suffixes; most registrars accept the leading @ or will append your apex automatically. New domains usually show seven records: four public mail records, one Amazon SES identity TXT, and two MAIL FROM records under mail. for Return-Path alignment.

DNS · Example for the domain studio.example

TypeNameValue

MX · prio 10@inbound.wm.emcognito.com.

TXT@v=spf1 include:emcognito.com include:amazonses.com -all

TXTk3f9a2._domainkeyv=DKIM1; k=rsa; p=MIIBIjAN…

TXT_dmarcv=DMARC1; p=reject; sp=reject; adkim=s; aspf=r; rua=mailto:dmarc-rua@studio.example

Aside

The DMARC rua address points at dmarc-rua@<your-domain> — a receive-only mailbox Folio creates and manages for you on this domain. Aggregate reports land in your /app/deliverability view, not your inbox, and you don't create the alias yourself. No separate _report._dmarc authorization record is needed.

·MX tells the world that letters for your domain should arrive at our inbound server.
·SPF (that first TXT) declares which senders are allowed to write on your behalf.
·DKIM (the _domainkey TXT) publishes the public half of a signing key generated for this domain alone; outgoing letters are signed with the private half.
·DMARC (the _dmarc TXT) tells receivers what to do if a letter arrives unsigned — and sends aggregate reports to Folio for review.
·SES identity (the _amazonses TXT) proves to Amazon SES that you control the domain.
·MAIL FROM (the mail. MX and SPF pair) aligns the outbound Return-Path with your domain instead of a shared carrier domain.

§ Verification

The setup page checks the records on its own while it is open and shows two milestones: Receiving turns green the moment the MX resolves (mail to the domain lands in Folio from then on), and Sending turns green when all seven records do. You do not need to wait on the page — background verification revisits pending domains and emails you when the domain is live. Most zones resolve in under ten minutes; Cloudflare, in our experience, is closer to two.

Aside

A domain can sit at pending for up to forty-eight hours without issue. Only at that point do we stop polling and ask you to check the records manually.

§ Sending enabled

Once the DNS, SES identity, and MAIL FROM gates are green, a final green badge appears on the domain: sending enabled. From that moment forward, any reply to a letter that arrived at *@studio.example will be sent from that domain, DKIM-signed in its own key.

If you only want to receive on a domain and never send, inbound routing can work before the outbound carrier gates finish. The UI keeps that distinction visible instead of pretending the domain is fully send-ready early.

§ Common questions

Which DNS records do I need to add?: Publish exactly what the wizard prints. The base set is MX, SPF, DKIM, and DMARC. Newer domains also show an _amazonses TXT record plus mail.<domain> MX and SPF records so Amazon SES can verify the identity and align the outbound Return-Path. The DMARC record's rua points at a dmarc-rua@<your-domain> mailbox Folio manages for you; you do not add a separate _report._dmarc authorization record.
How long does verification take?: Most registrars publish DNS changes inside two to ten minutes. The setup page checks on its own every thirty seconds while it's open, and Folio keeps checking in the background after you close it — you get an email the moment the domain is live.
Can Folio add the records for me?: Often, yes. If your DNS is at Cloudflare, create an API token with the Edit zone DNS template for that one zone, paste it on the setup page, and Folio writes all seven records and reports what it did; the token is used once and never stored. If your host supports Domain Connect (GoDaddy, IONOS, Squarespace Domains and others), a Connect button opens your host's own approval screen. Otherwise you can email the record set to whoever manages your DNS, or hand a ready-made brief to an AI assistant.
What if my registrar adds the apex automatically?: Most registrars (Cloudflare, Namecheap, Route 53) let you enter the @ symbol or leave the name field blank for an apex record. The wizard shows the suffix-only form; your registrar appends your domain automatically.
Can I bind a subdomain instead of an apex?: Yes. Bind mail.studio.example the same way you bind studio.example — the records are scoped to whichever zone you point at our infrastructure.