Email domain setup guide

How to configure your domain DNS so Driftrock can send emails on your behalf

To send emails on your behalf from your retailer group domain, Driftrock needs to be authorised to do so via your domain's DNS settings. This is a one-time configuration that your IT or domain administrator will need to complete.

We use Mailgun as our email delivery platform. Once we have added your domain to our Mailgun account, Mailgun will generate a set of DNS records specific to your domain. You will need to add these records to your domain's DNS configuration before any emails can be sent.

This guide walks you through each DNS record you need to add, why it matters, and what to expect once everything is in place. If you have any questions, please contact your Driftrock account manager.

Our team will handle the Mailgun setup on our end. This involves:

• Adding your retailer group domain to our Mailgun account

• Generating domain-specific DNS record values (SPF, DKIM, and tracking)

• Sharing those exact record values with you so your DNS administrator can add them

• Verifying the domain once the DNS records are live

We will send you the exact DNS record values — including the DKIM public key — once the domain has been added to Mailgun. The values in this guide use placeholders where the specific values are generated per domain.

You will need to add the following DNS records to your domain. Access to your domain's DNS management panel is required — this is typically through your domain registrar (e.g. GoDaddy, Namecheap, 123-reg) or your internal IT infrastructure team if DNS is managed in-house.

Step 1) SPF Record — authorise Mailgun to send on your behalf

SPF (Sender Policy Framework) tells receiving mail servers that Mailgun is permitted to send email from your domain. This is critical for deliverability and helps prevent your emails from landing in spam.

If you do not currently have an SPF record

Add the following new TXT record to your DNS: 

Do not add a second TXT record — DNS only supports one SPF record per domain. Instead, update your existing SPF record to include Mailgun. Find the line that begins with v=spf1 and add include:mailgun.org before the final ~all or -all. For example:

v=spf1 include:your-existing-provider.com include:mailgun.org ~all

Having two separate SPF records on the same domain will cause emails to fail authentication. Always merge into a single record.

Step 2) DKIM Records — cryptographically sign outgoing emails

DKIM (DomainKeys Identified Mail) adds a digital signature to every email sent from your domain via Mailgun. This allows receiving mail servers to verify that the email genuinely came from an authorised source and has not been tampered with in transit.

Mailgun uses two DKIM keys (Key 1 and Key 2) to support key rotation, which is best practice for ongoing security.

You will receive the exact values for these records from Driftrock. Add both of the following TXT records to your DNS: 

Replace yourdomain.com with your actual retailer group domain. The full DKIM key values are long strings beginning with "p=" — copy them exactly as provided, without any line breaks.

Step 3) Domain Verification Record — confirm domain ownership to Mailgun

Mailgun requires a one-time domain ownership verification. We will provide you with a unique TXT record that you add to your DNS. Once detected, this confirms that your organisation controls the domain and authorises Driftrock's Mailgun account to use it.

This record only needs to be present long enough for Mailgun to verify the domain. However, there is no harm in leaving it in place permanently.

 Step 4) Tracking CNAME — branded click and open tracking (recommended)

This optional record enables branded email tracking links and improves deliverability scores with some inbox providers. Without it, tracking links in emails will reference Mailgun's domain rather than yours. 

If your domain does not support CNAME records at the subdomain level, this step can be skipped. Please let your Driftrock account manager know if you are unable to add this record.

 Step 5) DMARC Record — domain abuse protection (strongly recommended)

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do if an email fails SPF or DKIM checks. It also enables you to receive reports on email authentication activity across your domain.

If you do not already have a DMARC record, we recommend adding one. A policy of p=none is a safe starting point — it monitors and reports without blocking any mail. 

Replace dmarc@yourdomain.com with an inbox you actively monitor — this is where aggregate reports will be delivered. If you already have a DMARC record in place, no changes are needed unless you wish to tighten the policy.

The table below summarises all records that need to be added. Driftrock will provide the specific values for items marked as [provided by Driftrock].

DNS changes can take between a few minutes and 48 hours to propagate globally, depending on your domain's TTL (time-to-live) settings and your DNS provider.

• Once you have added all the required records, let your Driftrock account manager know

• Driftrock will trigger domain verification in Mailgun

• Mailgun will check for the presence and correct format of each DNS record

• Once all records are verified, your domain status will show as Active in Mailgun

• Driftrock will confirm with you when the domain is verified and ready for sending