DNS Configuration for postchi.io Brand Domain

Overview

These DNS records configure postchi.io to send system emails (password resets, verifications, notifications) with maximum deliverability and reputation protection.

🔑 Generated DKIM Keys

Private Key (Add to Database)

Action Required: Save this private key securely and add it to the database for the postchi.io domain record.

📋 DNS Records to Add

1. SPF Record

Purpose: Specifies which servers are allowed to send email for postchi.io

Type:  TXT
Name:  postchi.io (or @ if using root)
Value: v=spf1 ip4:YOUR_SMTP_SERVER_IP -all
TTL:   3600

⚠️ Action Required: Replace YOUR_SMTP_SERVER_IP with your actual SMTP server IP address.

Strict Policy Explanation:

ip4:YOUR_IP - Only this IP can send
-all - Reject all other IPs (strict)
For brand domain, we want strict authentication

2. DKIM Record

Purpose: Cryptographic signature to verify email authenticity

Type:  TXT
Name:  default._domainkey.postchi.io
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnQSCsj9CQXWX8kCIyNe2r5e2V1ZBuDImAqR3LeyyG86FWr2WDLl2lVPknVzlZvpH03/Z/6aCbs5W7omkCtb2aiZPSeBh3Vy3D8ITaHQfTGs9w4JvWZNvgxNJpI1GNn3myM57CpVBBlTg3Gt49ZZgDbELq5pVbNuNmRy8QJdvzmeHumqvsz+q22S+Wfk7k0O5+W7xT6NqLxtmfPKS/WTqw/VFI0rRTw1B7zO3Xat03xqfFcljOzJxnYn1+YWDqBGoV38cDyklRSlDXVbjtLOgXceIwN6hEG3a1DjRNndmCZU6Rs94IO/vYfjDDiB8RkRoA4pFr2DSAsZ4xyTVmBewkQIDAQAB
TTL:   3600

Note: The public key is embedded in the value above. This matches the private key generated.

DKIM Selector: default

3. DMARC Record

Purpose: Policy for handling authentication failures + reporting

Type:  TXT
Name:  _dmarc.postchi.io
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@postchi.io; ruf=mailto:dmarc@postchi.io; pct=100; adkim=s; aspf=s
TTL:   3600

Policy Explanation:

p=quarantine - Quarantine emails that fail authentication (safer than reject initially)
rua=mailto:dmarc@postchi.io - Aggregate reports sent here
ruf=mailto:dmarc@postchi.io - Forensic reports sent here
pct=100 - Apply policy to 100% of emails
adkim=s - Strict DKIM alignment (domain must match exactly)
aspf=s - Strict SPF alignment (domain must match exactly)

Why Strict Alignment? For brand/system emails, we want maximum security. The sending domain (postchi.io) must exactly match the authenticated domain.

4. MX Records (for Bounce Handling)

Purpose: Receive bounce messages and delivery notifications

Type:     MX
Name:     postchi.io
Priority: 10
Value:    s1.mx.postchi.io
TTL:      3600

Type:     MX
Name:     postchi.io
Priority: 20
Value:    s2.mx.postchi.io
TTL:      3600

Note: Ensure s1.mx.postchi.io and s2.mx.postchi.io have A records pointing to your mail servers.

5. Reverse DNS (PTR Record)

Purpose: Maps IP back to domain for authentication

⚠️ Action Required: Contact your hosting provider to set up PTR record:

IP Address:        YOUR_SMTP_SERVER_IP
PTR Record Value:  mail.postchi.io

Most hosting providers (AWS, DigitalOcean, Linode) have a control panel for this.

Why Important?

Many email servers reject mail if PTR doesn't match
Critical for deliverability

🔍 Verification Steps

After adding DNS records, verify them:

1. Check SPF

dig TXT postchi.io +short

Should return: "v=spf1 ip4:YOUR_IP -all"

2. Check DKIM

dig TXT default._domainkey.postchi.io +short

Should return: "v=DKIM1; k=rsa; p=MII..."

3. Check DMARC

dig TXT _dmarc.postchi.io +short

Should return: "v=DMARC1; p=quarantine; ..."

4. Check MX

dig MX postchi.io +short

Should return both MX records

5. Check PTR (Reverse DNS)

dig -x YOUR_SMTP_SERVER_IP +short

Should return: mail.postchi.io.

📧 Testing Email Authentication

Use these free tools to test your configuration:

Mail-Tester - https://www.mail-tester.com/
- Send test email to provided address
- Get score out of 10
- Shows SPF, DKIM, DMARC status
MXToolbox - https://mxtoolbox.com/SuperTool.aspx
- Check DNS records
- Check blacklists
- Check SMTP
Google Postmaster Tools - https://postmaster.google.com/
- Add your domain
- Monitor reputation
- See spam rates
Microsoft SNDS - https://postmaster.live.com/snds/
- Register your IP
- Monitor reputation with Microsoft

🎯 Expected Results

After proper configuration, emails from noreply@postchi.io should:

✅ Pass SPF authentication ✅ Pass DKIM authentication ✅ Pass DMARC alignment ✅ Land in inbox (not spam) ✅ Show "Signed by postchi.io" in Gmail ✅ Display proper "via" domain

📝 Database Setup

After DNS is configured, add the postchi.io domain to your database:

INSERT INTO "Domain" (
  id,
  domain,
  "organizationId",
  "dkimSelector",
  "dkimPrivateKey",
  "verificationStatus",
  "createdAt",
  "updatedAt"
) VALUES (
  'GENERATE_CUID',
  'postchi.io',
  'YOUR_SYSTEM_ORGANIZATION_ID',
  'default',
  '-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCdBIKyP0JBdZfy...',
  'VERIFIED',
  NOW(),
  NOW()
);

⚠️ Action Required:

Replace GENERATE_CUID with a new CUID
Replace YOUR_SYSTEM_ORGANIZATION_ID with your system organization ID
Use the full private key from the top of this document

⏱️ DNS Propagation

DNS changes can take up to 48 hours to propagate globally, but usually complete within:

SPF/TXT Records: 1-4 hours
MX Records: 1-4 hours
DKIM Records: 1-4 hours
PTR Records: Immediate (set by hosting provider)

Tip: Use dig commands above to check if changes have propagated to your location.

🚨 Troubleshooting

Emails going to spam?

Check all DNS records are properly configured
Ensure PTR record is set
Verify IP is not blacklisted (use MXToolbox)
Check DMARC reports for failures
Warm up IP if brand new (see dedicated-ip-strategy)

DKIM signature failing?

Verify DKIM public key in DNS matches private key
Check selector is "default"
Ensure no extra spaces in DNS record
Private key must be in database exactly as shown above

SPF failing?

Verify IP address in SPF record is correct
Ensure emails are sent from that IP
Check for typos in SPF record

📚 Additional Resources

Dedicated IP Strategy - Full strategy for IP management
Email Deliverability Testing - Testing procedures
SPF RFC 7208
DKIM RFC 6376
DMARC RFC 7489

✅ Implementation Checklist

Last Updated: 2025-12-15 DKIM Keys Generated: 2025-12-15 Selector: default

Overview​

🔑 Generated DKIM Keys​

Private Key (Add to Database)​

📋 DNS Records to Add​

1. SPF Record​

2. DKIM Record​

3. DMARC Record​

4. MX Records (for Bounce Handling)​

5. Reverse DNS (PTR Record)​

🔍 Verification Steps​

1. Check SPF​

2. Check DKIM​

3. Check DMARC​

4. Check MX​

5. Check PTR (Reverse DNS)​

📧 Testing Email Authentication​

🎯 Expected Results​

📝 Database Setup​

⏱️ DNS Propagation​

🚨 Troubleshooting​

Emails going to spam?​

DKIM signature failing?​

SPF failing?​

📚 Additional Resources​

✅ Implementation Checklist​