> ## Documentation Index
> Fetch the complete documentation index at: https://cntillion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate an email domain

> Publish DKIM, SPF, and DMARC records and validate your company sender

DNS authentication lets Centillion send email from an address on your domain.
First [add the address and verify forwarding](https://cntillion.com/docs/channels/email-settings.md). Then
open **Authenticate domain** in its setup drawer.

Domain authentication verifies the sender. Automatic AI replies still require
Hobby or above and available [message credits](https://cntillion.com/docs/workspaces/billing.md).

An Owner or Member can configure and validate the domain in Centillion.
Publishing its records also requires access to your DNS provider. See
[workspace roles](https://cntillion.com/docs/workspaces/members.md).

## Copy the records from Centillion

Every row shows a record type, name, value, and verification status. An MX
record also has a priority. Add exactly those records to the DNS zone that
serves the domain.

| Check | Purpose | What to copy |
| - | - | - |
| DKIM | Signs outgoing messages so recipients can validate the sender | The provided domain-key record and value |
| SPF | Authorizes the sending service for the sending or return-path domain | Every provided SPF-related record, including an MX record if shown |
| DMARC | Publishes the domain's authentication policy | The `_dmarc` TXT record or the existing compatible policy |

Use the type shown in your account. Different mail services use different
combinations of TXT, CNAME, and MX records. Do not substitute an example record
from a guide or change a TXT record into a CNAME.

## Before adding records

The DNS host is the provider named in your domain's authoritative nameservers.
It may differ from the company where you bought the domain. Editing a DNS zone
that is no longer authoritative will not pass validation.

Some providers append the domain automatically. If Centillion shows
`selector._domainkey.example.com` and the form already appends `example.com`,
enter only `selector._domainkey`. Check the final name so it does not become
`selector._domainkey.example.com.example.com`.

Do not replace your main mailbox's MX records unless Centillion explicitly
shows that exact host. Sender authentication records often belong to a separate
return-path subdomain. Your existing mailbox still needs to receive customer
messages before forwarding them.

If a hostname already has an SPF TXT record, do not add a second SPF record at
that same name. Ask your DNS administrator to merge the required authorization
into the existing policy when appropriate. Likewise, keep a single DMARC TXT
record for a domain and review the existing policy before changing it.

## Cloudflare

1. Select the domain in the Cloudflare dashboard.
2. Open **DNS → Records** and choose **Add record**.
3. Select the type and copy the name and value from Centillion.
4. For mail authentication CNAME records, choose **DNS only** rather than proxied.
5. Set the priority for any MX record exactly as shown, then save.
6. Repeat for the remaining rows and validate in Centillion.

See [Cloudflare's record guide](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/).

## GoDaddy

1. Open the domain's **DNS** management page.
2. Choose **Add new record**.
3. Select the requested type and enter its name, value, and priority if needed.
4. Check whether GoDaddy appends the domain to the name. Save each record.
5. Return to Centillion and validate after the records propagate.

See [GoDaddy's CNAME guide](https://www.godaddy.com/en/help/add-a-cname-record-19236)
and use the same DNS manager for the other requested record types.

## Namecheap

1. Open **Domain List → Manage → Advanced DNS**.
2. Under **Host Records**, choose **Add New Record**.
3. Pick the requested type and enter the host, value, and any priority.
4. Save each row. Use the host portion when Namecheap appends the domain.
5. Validate in Centillion.

If the domain uses another provider's nameservers, add the records at that
provider. See [Namecheap's DNS guide](https://www.namecheap.com/support/knowledgebase/article.aspx/9646/2237/how-to-create-a-cname-record-for-your-domain/).

## Amazon Route 53

1. Open **Hosted zones** and select the public zone for the domain.
2. Choose **Create record** and use the simple record form.
3. Enter the name, requested type, and value. For MX, include the priority in
   the format required by the form.
4. Create the records, then validate in Centillion.

Use a public hosted zone. Records in a private zone are not visible to receiving
mail servers. See [Route 53's record guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html).

## Google Cloud DNS

1. Open **Network services → Cloud DNS** and select the public managed zone.
2. Choose **Add standard** or **Add record set**.
3. Enter the DNS name, resource record type, TTL, and supplied data.
4. Save each record set and validate in Centillion.

Check the final full name before saving. See [Google Cloud DNS records](https://cloud.google.com/dns/docs/records).

## Azure DNS

1. Open **DNS zones** in the Azure portal and select the public zone.
2. Choose **Record set**.
3. Enter the relative name, requested type, and value. Supply a priority for MX.
4. Save the record sets and return to Centillion to validate.

See [Azure's record-set guide](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-portal).

## Validate and select the sender

Return to **Settings → Email**, reopen the address, and choose **Validate**.
Centillion checks the required records and updates their individual statuses.

Allow **24 to 48 hours** for DNS propagation. If only one record fails, compare
that record with the setup drawer rather than replacing all of the records.

Once forwarding and the required DNS checks pass, select the address in
[Channels → Email](https://cntillion.com/docs/channels/email.md#reply-addresses) or
[Helpdesk email settings](https://cntillion.com/docs/helpdesk/email-settings.md). Authentication does not
automatically turn on AI replies.

## Troubleshoot a failing record

* Check that you edited the authoritative public zone for the exact domain or subdomain.
* Compare the record type, name, value, and MX priority character for character.
* Remove duplicate domain suffixes added by your provider's form.
* For CNAME, make sure the hostname does not also hold another record type.
* Keep mail authentication CNAME records unproxied in Cloudflare.
* Check for multiple SPF or DMARC TXT records at the same name.
* Retry after propagation. **Check failed** may mean a temporary lookup problem.

If forwarding passes but a sender still cannot be selected, inspect every DNS
status in the drawer. Forwarding proves incoming delivery; it does not authorize
outgoing mail from the company domain.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.