How do I get email on my own domain?

What is an email address on your own domain?

It is [email protected] instead of an address at a mail provider. Two things make it work. A mailbox on a server, and DNS records that tell other servers where the mailbox is and who may send as you.

Velumhold provides the mailbox. Email accounts on your own domain with webmail, IMAP and SMTP; outgoing mail is rate-limited to keep spam off the servers. Domains are not sold here: point a domain you own to the account with two nameservers or an A record. The DNS records live wherever your domain's DNS is managed. A person answers support emails within 12 hours, seven days a week, including help with DNS records, WordPress, email accounts and moving a site in.

Mailbox counts differ widely. According to Velumhold's survey of 2 November 2026, 5 of the 13 hosts that state an email count include unlimited email accounts in their entry plan, OrangeWebsite and Packetra include 3, and Hostinger's mailboxes are free for the first year only. Velumhold's Tulle includes 10.

What does an MX record do?

An MX record names the server that receives mail for your domain. A sending server asks DNS for the MX records of your domain and tries the lowest preference number first (RFC 5321, section 5.1). With no MX record, the sender falls back to the domain's own address record, so publish one on purpose. The target must be a host name with its own A or AAAA record, not a CNAME.

example.com.  3600  IN  MX  10  mail.example.com.
example.com.  3600  IN  MX  20  backup.example.com.

What does an SPF record do?

SPF lists the servers allowed to send mail for your domain. It is a TXT record that starts with v=spf1 (RFC 7208, section 3). Receivers compare the sending server with the list.

• One record only. Two SPF records on one domain make the check fail with a permanent error (sections 3.2 and 4.5).
• At most 10 DNS lookups. include, a and mx terms count. Beyond 10, the result is a permanent error (section 4.6.4).
• -all or ~all. -all says everything not listed is unauthorized. ~all is a soft fail, and receivers should not reject on that alone (sections 8.4 and 8.5).

example.com.  3600  IN  TXT  "v=spf1 ip4:203.0.113.25 -all"

What does a DKIM record do?

DKIM signs each message, so receivers can check it came from your domain and was not changed. The sending server adds a DKIM-Signature header. The matching public key sits in a TXT record at selector._domainkey.yourdomain.com (RFC 6376, sections 3.5 and 3.6.2). The selector lets a domain hold several keys and rotate them.

Google requires a DKIM key of 1024 bits or longer for mail to personal Gmail accounts, and recommends 2048 bits where supported.

default._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

What does a DMARC record do?

DMARC tells receivers what to do with mail that fails authentication, and where to send reports. It is a TXT record at _dmarc.yourdomain.com (RFC 9989, section 4.5, which replaces RFC 7489). The p tag takes none, quarantine or reject. The rua tag names an address for aggregate reports.

For a message to pass, SPF or DKIM must pass, and the domain they check must match the From domain. By default a match on the same organizational domain is enough. For domains whose users post to mailing lists, RFC 9989 advises p=none for at least a month, then p=quarantine for as long, before p=reject (section 7.4).

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

How do webmail, IMAP and SMTP fit together?

Webmail, IMAP and SMTP are three ways to read and send the same mailbox. Webmail runs in a browser. IMAP lets an app on your phone or computer work on mailboxes that stay on the server, so every device sees the same folders and flags (RFC 9051). SMTP sends. Submission from your app normally uses port 587, while servers relay among themselves on port 25 (RFC 6409).

RFC 8314 recommends TLS from the first byte: IMAP on port 993 and submission on port 465, with STARTTLS on port 587 also accepted. Pick the TLS options in your app. Moving from another host? Switch the MX records last, as in how to move a website without downtime.

What decides whether my mail lands in spam?

Authentication, complaints and volume. Google's sender rules apply to mail sent to personal Gmail accounts:

• All senders need SPF or DKIM, valid forward and reverse DNS, and TLS.
• Keep the spam rate in Postmaster Tools below 0.3%. Google's target is below 0.10%.
• Senders of more than 5,000 messages a day also need SPF, DKIM and DMARC, a From domain that matches the SPF or DKIM domain, and one-click unsubscribe on marketing mail.

Velumhold is built for ordinary mail, not mass mailing. Outgoing mail is rate-limited, and spam and bulk email are forbidden. See acceptable use.

What mistakes break email on a custom domain?

• Two SPF records on one domain. Merge them into one.
• More than 10 DNS lookups in SPF.
• An MX target that is a CNAME or has no address record.
• Several TXT records for one DKIM selector. The result is undefined (RFC 6376, section 3.6.2.2).
• p=reject on day one. Read the reports first.