> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bizzyco.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Email Deliverability (SPF, DKIM, DMARC)
> Check and fix the SPF, DKIM and DMARC records that decide whether mail from your domain reaches the inbox
New
Mailbox providers (Gmail, Outlook, and others) only trust mail from a domain
that authenticates correctly. Three DNS records do that work:
* **SPF** — lists who is allowed to send for your domain.
* **DKIM** — cryptographically signs your mail so it can't be tampered with.
* **DMARC** — tells receivers what to do with mail that fails SPF or DKIM, and
is increasingly required by major providers.
If these aren't right, your mail lands in spam or is rejected outright. Bizzy
surfaces the status of all three per domain, so you always know whether a domain
is ready to send.
## Where to find it
Open a domain from **Domains**, then go to the **Settings** tab. The **Email
Authentication** panel shows an overall verdict and the status of each record.
The verdict is one of:
| Verdict | What it means |
| ------------------ | ---------------------------------------------------------------------------- |
| **Ready to send** | Every required record is verified — the domain can send and receive |
| **Setting up** | Authentication is being configured; this can take a few minutes |
| **Almost ready** | Your records are published, but the email provider hasn't confirmed them yet |
| **Action needed** | Setup didn't complete — the message on the panel says why |
| **Not configured** | Email isn't enabled on this domain yet |
**Action needed** distinguishes two very different situations. If your DNS
records are missing or failed verification, add the records listed below the
panel, then click **Retry setup** to run verification again — **Re-check** only
refreshes the current status and can't restart a verification that has already
failed. If setup failed on Bizzy's side instead (a provider or configuration
problem), the panel says so explicitly — your DNS is not the problem, and the
fix is the same **Retry setup**, or contacting support if it keeps failing.
**Almost ready** means there is nothing left for you to add: every required
record resolves publicly, but the email provider has not accepted them yet.
Click **Retry setup** to run verification again. **Retry setup** is available
whenever setup has failed, whatever the reason.
### Record status
Each record row carries its own status, so you can see exactly which one is
holding the domain back:
| Status | What it means |
| ---------------- | --------------------------------------------------------------------- |
| **Verified** | The email provider accepted this record |
| **Found in DNS** | The record resolves publicly, but the provider hasn't accepted it yet |
| **Pending** | Expected, not confirmed yet |
| **Missing** | Expected and not found — add it from the details shown on the row |
| **Auto-managed** | Bizzy controls the DNS zone and maintains this record for you |
| **Recommended** | Optional but advised (DMARC on domains you host DNS for elsewhere) |
**Found in DNS** is deliberately distinct from **Verified**: publishing a record
is not the same as the provider accepting it, and a domain can have every record
published while still being unable to send. DMARC is the exception — Bizzy
checks it directly, so a published policy shows as **Verified**.
### Every required record must verify
A domain is ready only once **all** of its required records verify — sending
(SPF + DKIM) and receiving (the inbound `MX`) alike. If your domain already has
`MX` records pointing at another mail host such as Google Workspace or Microsoft
365, they conflict with the inbound record and setup will report a failure until
that's resolved. Consider using a subdomain for Bizzy email instead, which
avoids the conflict entirely.
## Registered vs. verified domains
How you manage these records depends on how the domain got into Bizzy:
* **Registered through Bizzy** — Bizzy controls the DNS zone, so SPF, DKIM and
DMARC are added and kept in sync **automatically**. The panel shows each
record as **Auto-managed**; there is nothing for you to do.
* **Verified (DNS hosted elsewhere)** — you add the records yourself. The panel
shows the exact **name**, **type** and **value** for each record, with a copy
button. Names are shown as the label to enter at your DNS host — most
providers append your domain automatically — and `@` means the domain itself.
Add them at your DNS provider, then re-check.
## The records
For a verified domain you'll add **every record the panel lists** — email on
Bizzy covers receiving as well as sending, so alongside SPF and DKIM there is an
MX record that routes inbound mail for your domain to Bizzy. Add each one
exactly as shown (MX records include the priority displayed). DMARC is handled
differently depending on whether your domain already publishes a policy:
| Record | Type | Notes |
| ------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| **SPF** | `TXT` + `MX` | Authorize Bizzy to send for your domain and route bounce feedback; both live on a sending subdomain (e.g. `send.`) |
| **DKIM** | `TXT` | Publishes the public key used to verify your mail's signature |
| **Receiving** | `MX` | Routes inbound mail to Bizzy — published at your domain itself (name `@`) |
| **DMARC** | `TXT` | Published at `_dmarc.` — see below |
**If your domain already publishes DMARC**, Bizzy detects it and shows the
record as **Verified** with your own policy value. Your existing policy is never
overwritten, duplicated, or replaced with a weaker one — this applies to
registered domains too, where Bizzy otherwise manages the zone.
**If no DMARC policy exists yet**, Bizzy recommends a safe starting policy (and
writes it to the zone automatically for registered domains):
```dns theme={null}
_dmarc.example.com. IN TXT "v=DMARC1; p=none;"
```
DMARC handling: an existing `_dmarc.` policy is detected during
setup and on every re-check, shown as Verified with the domain's own
value, and never overwritten or duplicated. Only when no policy exists is
the starter recommended (and auto-provisioned for registered domains):
name `_dmarc.`, type `TXT`, value `v=DMARC1; p=none;`. `p=none` is
monitoring mode — receivers report on, but do not quarantine or reject,
failing mail. Tighten to `p=quarantine` or `p=reject` once alignment is
confirmed.
`p=none` is **monitoring mode**: it asks receivers to report on failures without
sending mail to spam. It's the right place to start on a new domain. Once you're
confident everything authenticates, you can tighten the policy to `p=quarantine`
or `p=reject` at your DNS provider — Bizzy picks up the change on the next
re-check.
## Re-checking
Bizzy checks for your records automatically. During setup the checks run
frequently in the first hour after you enable email, and the panel updates live
as setup progresses, so you don't need to refresh the page. Once the domain is
verified, every sending domain is re-validated on a schedule — roughly once a
day — so authentication that breaks later doesn't go unnoticed.
To force a fresh look at any time, click **Re-check**: Bizzy reads the latest
verification status from its sending provider and resolves each record live
over DNS — including DMARC, where the observed policy is saved so the panel
keeps reflecting it — and updates the status. If the DMARC lookup itself can't
complete (a temporary DNS hiccup), the previously saved policy stays in place
rather than being cleared. DNS changes can take a few minutes to propagate, so
if a record you just added still shows as missing, wait a little and re-check.
**Re-check** never starts a new verification — it only refreshes what Bizzy can
already see. If verification has failed and you've since corrected your records,
click **Retry setup** to run it again.
## If authentication breaks later
DNS can drift after a domain goes live — a record edited at your DNS host, a
rotated key, a DMARC policy that was removed. When a scheduled re-validation
(or a manual **Re-check**) finds previously verified records no longer valid,
the panel flips to **Action needed** and names the records at fault. When the
scheduled check is what catches the breakage, organization owners and admins
also receive an **Authentication broken** notification (see
[Notifications](/admin-guide/notifications)); a manual **Re-check** updates
the panel you're already looking at without sending one. A DMARC policy
only counts as broken if Bizzy had previously seen one published — removing a
policy you never added is not flagged, and a temporary DNS hiccup never
triggers an alert on its own.
To fix it, restore the records shown in the panel (the values are copyable),
then click **Re-check** — the warning clears as soon as the records verify
again, or automatically on the next scheduled check.
## Before you create an email address
When you add an email address, only domains that are **ready to send** appear in
the domain picker. If a domain has email setup underway but not finished, a
warning lists it with its current status and a link straight to its settings, so
you can finish authentication before relying on it.
## Removing a domain
Deleting a domain also retires its email configuration: Bizzy revokes the
sending credential it created for the domain and removes the domain from the
email provider. This happens however the domain is deleted — from the app, the
API, by asking your agent, or automatically when a registered domain is removed
at the registrar.
If the email provider is unreachable at that moment, the deletion still goes
through — a provider outage never leaves you with a domain you cannot remove —
and Bizzy records any credential it could not revoke rather than losing track
of it. A credential recorded that way while email setup is still in progress is
retired automatically on the next attempt; one recorded during the deletion
itself is kept for support to clear, since the domain is gone by then.
What happens to the DNS records depends on how the domain came to Bizzy:
* **Externally registered (verified) domains** can be deleted at any time. The
DNS records stay at your DNS host — if you're done with the domain, remove
the SPF, DKIM, DMARC and MX records listed above yourself; leaving them in
place is harmless but advertises a mail setup that no longer exists.
* **Domains registered through Bizzy** can only be deleted once the
registration has expired and the domain's DNS zone is empty (apart from the
records every zone is created with). Disable email for the domain first so
Bizzy removes the email records it manages, then delete any remaining
records from the domain's DNS tab. The delete option stays unavailable —
with an explanation — until the registration expires; if DNS records remain
after that, the deletion is refused with a message naming them. A renewal
you have already started also blocks the deletion until it finishes. This
protects you from losing sight of a registration that is still active — or
still renewing — at the registrar.
## Troubleshooting
| Problem | Likely cause | Fix |
| --------------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Record added but still shows missing | DNS hasn't propagated yet | Wait a few minutes — Bizzy re-checks automatically; **Re-check** any time |
| DKIM won't verify | Value copied incompletely — DKIM keys are long | Use the copy button and paste the value exactly, with no added whitespace |
| Sending works but mail doesn't arrive | Receiving `MX` record missing or rejected | Add the MX record shown in the panel, including its priority. If your domain already has MX records for another mail host, they conflict — see below |
| DMARC shows as recommended | No `_dmarc` record published yet | Add the `_dmarc` TXT record above, then re-check |
| DMARC still shows recommended after adding it | The panel hasn't re-checked yet | Click **Re-check** — it then shows **Verified** with your policy |
| Panel says setup failed on Bizzy's side | A provider or configuration problem | Your DNS is fine — **Retry setup**, and contact support if it keeps failing |
| Verdict stuck on "Setting up" | Verification still in progress | The page updates as setup progresses; **Re-check** forces a fresh look |
| Verdict is "Almost ready" and stays there | Records are published but the provider hasn't confirmed them | Click **Retry setup** to run verification again; contact support if it keeps failing |
| Records show "Found in DNS", not "Verified" | The provider hasn't accepted them yet | Nothing to add — **Re-check**, then **Retry setup** if it doesn't clear |
## Next steps
Once a domain is ready to send
For domains registered through Bizzy