What DMARC record does Fastmail set up by default?

v=DMARC1; p=none; — exactly that, whether Fastmail hosts your DNS (it publishes the record automatically) or you use external DNS (its guides give you the same value to add). Two consequences owners miss: p=none is monitoring-only, so nothing is enforced, and the default record has no rua reporting address, so you do not even receive the reports that monitoring mode exists to produce. Fastmail never advances the policy for you: raising it is a manual act in both setups (on Fastmail-hosted DNS you disable the auto-generated record and create your own quarantine/reject record with your reporting address). Fastmail's own BIMI documentation supplies a motive to climb — BIMI display requires a quarantine or reject policy.

How does Fastmail handle DKIM keys for custom domains?

By delegation, like Proton and Microsoft: you publish three CNAME records — fm1._domainkey, fm2._domainkey and fm3._domainkey — pointing to fm1, fm2 and fm3 at .dkim.fmhosted.com, and Fastmail holds and manages the keys behind them. Fastmail's manual DNS documentation states plainly that all three CNAMEs are required. Fastmail does not document why there are three or a rotation schedule, and does not state the key size in its help pages — claims beyond that are folklore. One useful stale-guide detector: the pre-2018 mesmtp._domainkey selector is explicitly deprecated in Fastmail's current docs, so any tutorial still teaching it is out of date. At Cloudflare, these CNAMEs must be DNS-only (grey cloud) like every delegated key record in this series.

Fastmail · Custom domain · Setup

Fastmail custom domain: everything set up — except the policy climb

First published 20 October 2026 · Records, defaults and warnings from Fastmail's help centre read in full. Fastmail's 2016 blog contradicts its current help on DMARC defaults; the help pages govern (§Sources).

“DMARC is on” is doing heavy lifting. Fastmail's automatic DMARC is v=DMARC1; p=none; — no enforcement, and no rua, so not even reports. It is a perfectly good starting record that most domains simply never leave, because nothing in Fastmail ever prompts the climb. This guide's job: set up everything Fastmail way, then do the one manual thing Fastmail leaves to you (§4).

The two doors

Door	What Fastmail does	What you watch
A — Fastmail hosts DNS (nameservers → Fastmail)	Publishes the full set automatically: MX pair, SPF, the three DKIM CNAMEs, the default DMARC — plus extras (wildcard subdomain MX, web/webmail CNAMEs, an SRV autodiscovery set), all TTL 1 hour, editable in Customize DNS	The website trap, in Fastmail's own words: “It is not a good idea to change nameservers without preparation if you already have a website on your domain.” Nothing carries over; the default zone points web at Fastmail's file storage. Inventory and rebuild every record (site, verification TXT, everything) in Customize DNS — before or immediately after the switch
B — External DNS (MX-only move)	Wizard verifies the manual set (§table) and re-checks it (hourly for external setups)	Copy fidelity: all records, exactly — partial copies are the classic Fastmail failure
Both doors require at least one account admin on a non-Basic plan (Fastmail's own wording). A third documented pattern — neither NS nor MX at Fastmail, mail filtered/redirected in — exists for edge cases; it's not a business default.

The record set (external DNS / verification reference)

Record	Name	Value
MX	`@`	`in1-smtp.messagingengine.com` (10) · `in2-smtp.messagingengine.com` (20) — the domain's only MX records
TXT (SPF)	`@`	`v=spf1 include:spf.messagingengine.com ?all` — note Fastmail's real ending is `?all` (neutral), which most third-party write-ups mistranscribe as `~all`. Copy Fastmail's, not the internet's
CNAME ×3 (DKIM)	`fm1._domainkey` · `fm2._domainkey` · `fm3._domainkey`	`fmN.<yourdomain>.dkim.fmhosted.com` — “you'll need to add all three CNAME records” (Fastmail's manual DNS page)
TXT (DMARC)	`_dmarc`	`v=DMARC1; p=none;` — the default you're about to improve in §4

The ladder (external DNS)

Add the domain in Settings → Domains; choose the MX-only route.
Publish MX + SPF + the three DKIM CNAMEs + DMARC from the table (merging the SPF include into an existing record if other senders share the domain — Articles #3/#18).
Recheck DNS in Fastmail: the domain shows a green tick (a red exclamation comes with fix advice — Fastmail's BIMI page confirms a clean recheck means SPF and DKIM are correctly set). Door statuses read “Active. MX records set” (or “…Nameservers set” on Door A).
Send test mail out and in; verify headers (§Verify).
Do §4 — the step that isn't Fastmail's.

§4 — the climb Fastmail leaves to you

Add reporting first: replace the default DMARC with your own carrying rua=mailto:you@yourdomain (still p=none). On Fastmail-hosted DNS: disable the auto-generated record, create yours in Customize DNS. On external DNS: edit your record.
Read reports for a cycle or two (Article #36): Fastmail should appear as an aligned source on both legs.
Climb to p=quarantine, then p=reject (Article #4's gates). Motive beyond hygiene, from Fastmail's own docs: its BIMI page notes logo display requires an enforcing policy — the default record can never qualify you (Article #37).
Subdomains inherit the root policy (sp defaults to p — specification behaviour, Article #40) — set sp explicitly if your streams differ.

Verify

Fastmail: green tick + clean Recheck; ongoing re-checks run daily (hosted) / hourly (external) — a record broken later surfaces here, a genuinely nice touch.
Headers: outbound test shows dkim=pass with d= your domain; inbound filtering benefits from senders' checks as usual.
Readbacks: one SPF (with Fastmail's ending intact), three CNAMEs resolving to fmhosted.com targets, your upgraded _dmarc.

Traps

Trap	Reality
The nameserver door, unprepared	Mail perfect, website gone (records didn't migrate). Fastmail warns in writing — believe it
`mesmtp._domainkey` from an old tutorial	Deprecated selector. Its presence means your source predates 2018; use fm1–fm3
DNSSEC from your registrar still on after moving DNS	Fastmail documents DNSSEC as unsupported on its hosting and a mail-breaker — disable it at the registrar for Door A
“Fastmail handles DMARC”	It handles a starter record. Enforcement, reporting and the climb are yours (§4) — same division of labour as every host in this series, just friendlier about the first 90%

FAQ

Why three DKIM selectors if Fastmail won't explain them?

Print only what's documented: all three are required; keys live at Fastmail. (Rotation redundancy is the obvious engineering reading — labelled inference if you repeat it, not Fastmail's statement.)

My BIMI record is published but no logo shows.

Check the gate (Article #37): with Fastmail's default p=none you fail the first condition. §4's climb is the fix — plus the certificate Gmail demands.

Can I keep my registrar's DNS and still get the automatic DMARC?

The automatic record exists only on Fastmail-hosted DNS; on external DNS you publish the identical value yourself (and your improved version later) — same record, your hands.

Sources

Fastmail Help — Custom domains hub · NS/MX setup (nameserver warning) · MX-only setup · Manual DNS configuration (the record set; “add all three CNAME records”; ?all SPF) · DMARC page (default p=none) · Sender authentication · BIMI page (recheck meaning; enforcement requirement) · DNSSEC note. Fastmail's 2016 blog post claiming no default DMARC is stale against the current help and is not relied on.

Verification note: records, defaults and statuses were confirmed from Fastmail's help centre on 20 October 2026. Why three selectors exist, any rotation cadence, and DKIM key sizes are not stated by Fastmail — the guide prints their absence rather than the folklore.

Did this guide work for you?

Your reaction tells us whether this guide solved the problem it promised to solve.