# Manual DNS records

> Add Faivelo's DNS records at any provider.

If your DNS provider isn't supported for [automatic setup](/domains/automatic-dns-setup) — or you'd rather not share an API key — you can add Faivelo's records by hand at any provider. It takes about a minute.

## Where your records live

After you [add a domain](/domains/adding-a-domain), open it under [faivelo.com/domains](https://faivelo.com/domains) and go to its **DNS Records** page. Every record is listed there with its exact **Type**, **Name**, and **Value** — click any of them to copy. Always copy from your dashboard rather than from this page: some values (like DKIM keys and verification tokens) are unique to your domain.

In your DNS provider's dashboard, find the DNS management screen (often called "DNS", "DNS Records", "Advanced DNS", or "Zone Editor") and create one record per row.

## The records, explained

Here's what Faivelo asks you to add and why. `yourdomain.com` stands in for your domain; unique values are shown as placeholders.

<table>
<thead>
  <tr>
    <th>
      Type
    </th>
    
    <th>
      Name
    </th>
    
    <th>
      Value (example)
    </th>
    
    <th>
      What it does
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      MX
    </td>
    
    <td>
      <code>
        @
      </code>
    </td>
    
    <td>
      <code>
        mx.faivelo.com
      </code>
      
       (priority <code>
        10
      </code>
      
      )
    </td>
    
    <td>
      Routes incoming mail to Faivelo
    </td>
  </tr>
  
  <tr>
    <td>
      TXT
    </td>
    
    <td>
      <code>
        @
      </code>
    </td>
    
    <td>
      <code>
        v=spf1 mx include:amazonses.com -all
      </code>
    </td>
    
    <td>
      SPF — authorizes Faivelo to send for you
    </td>
  </tr>
  
  <tr>
    <td>
      TXT
    </td>
    
    <td>
      <code>
        _dmarc
      </code>
    </td>
    
    <td>
      <code>
        v=DMARC1; p=quarantine; sp=quarantine; adkim=r; aspf=r; pct=100; fo=1; rua=mailto:admin@faivelo.com
      </code>
    </td>
    
    <td>
      DMARC — sends spoofed mail to spam
    </td>
  </tr>
  
  <tr>
    <td>
      CNAME
    </td>
    
    <td>
      <code>
        <token>._domainkey
      </code>
      
       (×3)
    </td>
    
    <td>
      <code>
        <token>.dkim.amazonses.com
      </code>
    </td>
    
    <td>
      DKIM — cryptographically signs your outbound mail
    </td>
  </tr>
  
  <tr>
    <td>
      TXT
    </td>
    
    <td>
      <code>
        _amazonses
      </code>
    </td>
    
    <td>
      <code>
        <verification token>
      </code>
    </td>
    
    <td>
      Verifies your domain with the sending relay
    </td>
  </tr>
  
  <tr>
    <td>
      MX + TXT
    </td>
    
    <td>
      <code>
        bounce
      </code>
    </td>
    
    <td>
      relay bounce host / <code>
        v=spf1 include:amazonses.com ~all
      </code>
    </td>
    
    <td>
      Handles bounces from your own domain
    </td>
  </tr>
  
  <tr>
    <td>
      CNAME
    </td>
    
    <td>
      <code>
        mta-sts
      </code>
      
      , <code>
        autodiscover
      </code>
      
      , <code>
        autoconfig
      </code>
    </td>
    
    <td>
      <code>
        mx.faivelo.com
      </code>
    </td>
    
    <td>
      Enforces TLS and lets mail apps auto-configure
    </td>
  </tr>
  
  <tr>
    <td>
      TXT
    </td>
    
    <td>
      <code>
        _mta-sts
      </code>
      
      , <code>
        _smtp._tls
      </code>
    </td>
    
    <td>
      <code>
        v=STSv1; ...
      </code>
      
       / <code>
        v=TLSRPTv1; ...
      </code>
    </td>
    
    <td>
      Secure-transport policy and TLS failure reports
    </td>
  </tr>
</tbody>
</table>

A few provider quirks to watch for:

- **Name field:** most providers want the *relative* name — `@` for the domain itself, `_dmarc` rather than `_dmarc.yourdomain.com`. Faivelo's dashboard shows names in this relative form. If your provider expects the full name, append your domain.
- **MX priority:** enter `10`. Some providers have a separate priority field; others want it at the start of the value (`10 mx.faivelo.com`).
- **DKIM CNAMEs:** there are three, each with a different token. Add all three exactly as shown.

<docs-aside title="Only one SPF record" type="caution">

A domain may have only **one** SPF TXT record. If you already have one (from Google Workspace, a newsletter tool, etc.), don't add a second — merge the `include:` parts into a single record. See [Troubleshooting DNS](/domains/troubleshooting).

</docs-aside>

<docs-aside title="Cloudflare users" type="tip">

Set every mail-related record to **DNS only** (grey cloud). Proxied (orange cloud) records break mail delivery and verification.

</docs-aside>

## After you've added them

Head back to your domain's DNS page in Faivelo. Records typically verify within a few minutes; Faivelo also re-checks automatically in the background, and you can click **Re-check All** at any time. Propagation occasionally takes longer — up to 48 hours in rare cases.

## Next steps

- [How verification works](/domains/verification)
- [Troubleshooting DNS](/domains/troubleshooting) if a record stays Pending or shows Mismatch