If you wish to use your existing email domain for emails sent from AroFlo, you can configure this for any Business Unit, or for your entire Company.
A Valid Domain
Email sending domains are an advanced feature that will require you to edit DNS and mail server settings, which can involve complexities. AroFlo can provide guidance and advice but cannot change your computer systems for you.
If you do use your own sending domains, you must ensure that the settings are always valid. AroFlo can only provide limited assistance for any delivery issues.
The below document is intended for people with advanced knowledge of systems and domain administration, such as your IT administrator.
Introduction
Without email sending domains being configured, emails sent from AroFlo use one of our system domains:
- inboundemail.aroflo.com
- notifications.aroflo.com
By configuring Email Sending Domains, email sent from AroFlo will appear to come directly from your company email address.
Benefits of Email Sending Domains
- Professional. Emails look like they come directly from your business account.
- Consistent. Strengthen your branding and business identity with every email.
- Engaging. Emails that look familiar are less likely to be treated as spam.
- Trusted. Proper configuration helps to ensure more emails reach inboxes instead of spam folders.
Prerequisities
Before setting up your own email sending domain, you will need:
- ownership of your company’s domain (for example, yourdomain.com).
- access to edit your domain’s DNS Zone (usually through cPanel or your Web Hosting Provider’s DNS Zone Editor).
Important Considerations
- AroFlo uses Mailgun as its Email Service Provider.
- Required authentication checks via DNS such as SPF, DKIM and DMARC must be correctly implemented.
- These settings must be maintained to ensure uninterrupted service and compliance with email security standards.
- AroFlo Support can only provide limited assistance for setup and delivery issues.
- Non-compliant domains may be removed by AroFlo, and Email Sending Domains disabled.
List of steps involved
The below are the main steps involved in setting up your own Email Sending Domain, which this document will outline
- Add an Email Sending Domain
- Verify Domain Ownership
-
Validate the Domain
- Set up an SPF (Sender Policy Framework) Record
- Set up a DKIM (DomainKeys Identified Mail) Record
- Set up a CNAME (Canonical Name) Record
- Set up a DMARC (Domain-based Message Authentication, Reporting and Conformance) Record
- Finalise Setup.
Access and add an Email Sending Domain
For most setups, it is best to configure your sending domain in the top-level Company / Business Unit. For more complex setups or multiple sending domains, per Business Unit configuration is possible.
- In Site Administration, select the correct Business Unit (if applicable).
- Click Settings > Email > Email Sending Domains.
Add Sending Domain
- Click Add Sending Domain.
- Type the Domain in the Domain field.
- Click Save Email Sending Domains.
Archive Email Sending Domain
If you no longer require a custom domain in your AroFlo subscription, you can remove it:
- Tick the ‘Archive’ box for the relevant domain
- Save Email Sending Domains.
View archived
Use the dropdown at the top-right to switch between Active and Archived Domains.
Verify Domain Ownership
Before the domain name can be activated, it must first be verified so AroFlo can be sure you are in control of the domain. To do this, AroFlo generates a unique DNS TXT record, which must be added to the root of your domain.
Generate the TXT record to add
In the Email Sending Domains window:
- Click Verify Domain Ownership.
- A unique Domain Ownership Verification TXT record will be generated. This is the record that must be added as a DNS TXT record to the root of your domain. Copy the unique TXT record to your domain DNS.
- Once the TXT record has been added, click Verify Domain Ownership again. You should see a green tick
in the Ownership column.
Example of verification check failure
Example: How to add a TXT record
Adding the DNS record must be performed either by yourself, your website host, or your IT provider. Our support team can advise what you need to add or change, but it is outside the scope of support to manage client DNS records.
Each provider’s control panel looks different, but is reached by locating the DNS Zone Editor.
The below screenshots show what this looks like in cPanel, one of the most widely-used interfaces.
- Log into cPanel as per your Host’s instructions.
- Click on Zone Editor under Tools > Domains.
- Click on yourdomain.com, then use the dropdown to Add “TXT” Record.
- Add the record and Save Record.
Other interfaces may build the domain name into the editing window. As shown in the Edit TXT Records (SPF) window, it would be easy to accidentally make a new subdomain called yourdomain.yourdomain.com, which would occur if you were to type yourdomain in the Name field.
Always ensure the record pasted is exactly as it appears when generated on the Email Sending Domains window.
.window.png)
DNS Lookup for Verification of Domain Ownership
A DNS record can take anywhere from 5 minutes to 48 hours to update across the globe, but generally most records update within 2 to 15 minutes.
You can check the availability and correctness of the record using tools such as MX Toolbox, or command line tools such as nslookup or dig.
If the record does not show, it has either been entered incorrectly, or hasn’t yet propagated to the DNS Server performing the lookup.
You can also use Command Line tools such as Dig (MacOS / Linux) or Nslookup (Windows):
Dig (MacOS / Linux)
dig yourdomain.com TXT
Nslookup (Windows)
nslookup -type=TXT yourdomain.com
Validate the Domain
|
Once you have verified ownership, the Verify Domain Ownership button will change to Validate Domain. Click this to generate the necessary DNS records in the order of:
These are additional records you need to add via your DNS Zone Editor. |
 |
|
SPF (Sender Policy Framework) Record
An SPF record (type TXT), is a type of DNS record that lists the servers or IP addresses authorised to send email on behalf of your domain. It is one of the ways mail servers detect and filter out illegitimate email.
The SPF is the first record list in the Domain Validation Information window:
If your domain is already used to send email (e.g. via Microsoft 365 or Gmail), you will already have an SPF record which will need to be edited.
For example, if your domain currently uses Microsoft 365 to send emails, the existing SPF record may look like this:
Host / Name: yourdomain.com
Value / Record: v=spf1 include:spf.protection.outlook.com ~all
To allow AroFlo’s Mailgun account to send emails on your behalf as well, you would need to add include:mailgun.org to the record like this:
Host / Name: yourdomain.com
Value / Record: v=spf1 include:spf.protection.outlook.com include:mailgun.org ~all
❗ Note about SPF Records
Only ONE SPF record is allowed per domain.
If multiple SPF records are found, receiving mail servers will only use the first one returned when it looks for the record and ignore the rest.
❗ This will result in emails from both AroFlo and your own systems being marked as spam or rejected altogether. ❗
Incorrect (invalid) configuration:
v=spf1 include:spf.protection.outlook.com ~all
v=spf1 include:mailgun.org ~all
Correct (combined) configuration:
v=spf1 include:spf.protection.outlook.com include:mailgun.org ~all
SPF Record Example
To add the record, ensure the type is TXT, the domain is the root (e.g. yourdomain.com), and you have correctly copied and pasted the record in.
Your DNS Zone Editor might look something like this.
DNS Lookup for SPF Records
Performing a DNS lookup for SPF is much the same as a standard text record. Note it should return only 1 ‘v=spf1’ record.
You can also use Command Line tools such as Dig (MacOS / Linux) or Nslookup (Windows):
Dig (MacOS / Linux)
dig yourdomain.com TXT
Nslookup (Windows)
nslookup -type=TXT yourdomain.com
DKIM (DomainKeys Identified Mail) Record
A DKIM record is a required email authentication method that helps prevent email spoofing through the use of cryptographic keys. It ensures the email has not been tampered with.
The DKIM record utilises a Private Key and a Public Key.
The Private Key is stored on the mail server which is sending the email, such as your own mail server, or Mailgun. Any emails sent are then signed with this key.
The Public Key is what is actually published in your domain’s DNS as a TXT record.
When the receiving mail server receives the signed email, it uses the Public Key DNS record (DKIM) to check with the server that the message is legitimate.
If the Public Key is a match to the Private Key, then the email goes to the Inbox of the receiver. If not, then it goes to the spam/junk folder or is rejected.
The DKIM record value generated by AroFlo provides you with the public key that you need to add to your DNS. This is always unique.
Note about DKIM Records
The DKIM record has two main parts: a specific Host name (also called a ‘selector' or 'sub-domain’) and the Value (the public key).
The Host part directs mail servers to the correct public key in your DNS for the mail server you are using, in the case of multiple DKIM records for different mail services.
It is crucial that the Host name is entered correctly. Your DNS provider may automatically add your domain name to the end of the Host entry. Pay close attention to this to avoid creating an incorrect record.
The selector/host also acts to ensure this additional DKIM record does not affect any other DKIM records you may have on your domain for other servers.
Unlike the SPF record, you can have multiple DKIM records, providing they use a different selector.
DKIM Record Example
To add the record, create a new TXT record in your DNS Zone Editor using the values generated in AroFlo. Your DNS provider will typically add the yourdomain.com part automatically.
Host / Name / Selector (will be one of): mx._domainkey k1._domainkey smtp._domainkey mailo._domainkey krs._domainkey pic._domainkey
Value / Record Data (this value is an example only): k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrL+GuHk2…
Adding the DKIM
Your DNS Zone Editor will look something like this after adding the record:
Check the Host
If you enter mx._domainkey.yourdomain.com into a Host field that automatically adds your domain, you will incorrectly create a host value of mx._domainkey.yourdomain.com.yourdomain.com.
Be sure to check before saving.
DNS Lookup for DKIM Records
Performing a DNS lookup for a DKIM is much the same as a standard text record. The only thing to check is the selector is included when doing the lookup.
You can also use Command Line tools such as Dig (MacOS / Linux) or Nslookup (Windows):
Dig (MacOS / Linux)
dig mx._domainkey.yourdomain.com TXT
Nslookup (Windows)
nslookup -type=TXT mx._domainkey.yourdomain.com
It should then return the full record starting from k=rsa and ending in QAB.
CNAME (Canonical Name) Record
The CNAME record works like a redirect, so when arofloemail.yourdomain.com is accessed, it will send the request to Mailgun’s servers at mailgun.org.
A CNAME record is required to ensure email tracking works, and any hyperlinks in emails sent correctly redirect via arofloemail.yourdomain.com.
Failure to add a CNAME record will result in any hyperlinks in emails returning a 404 not found error, including any links within images. Also, email tracking will not work.
Adding a CNAME Record in your DNS Zone Editor
Adding a CNAME follows much the same process as adding a TXT record. Log into your DNS Zone Editor, select your domain, then click on Add “CNAME” Record.
Email Tracking in AroFlo
With a CNAME record set up and configured, email tracking will be enabled by default for your domain.
Tracking status shows in the copy of the email saved to the Note in AroFlo.
Tracking Icons
| Icon | Meaning | Description |
|---|---|---|
|
Delivered | A timestamp of when the message was delivered to the recipient’s mail server. |
|
Opened | A timestamp showing when the message was opened. This is dependent on the CNAME record being correct and the recipient allowing images to be downloaded. |
|
Clicked | Clicked is disabled unless by special request as it requires all hyperlinks in an email to route through Mailgun. |
|
Marked Spam | If your email has been marked as spam by the recipient (dependent on the email client). |
DNS Lookup for CNAME Records
Performing a DNS lookup for a CNAME Record is a little different as a CNAME is a special type. This means changing to CNAME in the dropdown and entering arofloemail.yourdomain.com in the lookup field.
You can also use Command Line tools such as Dig (MacOS / Linux) or Nslookup (Windows):
Dig (MacOS / Linux)
dig arofloemail.yourdomain.com CNAME
Nslookup (Windows)
nslookup -type=CNAME arofloemail.yourdomain.com
It should then return the full record starting from k=rsa and ending in QAB.
DMARC (Domain-based Message Authentication, Reporting and Conformance) Record
DMARC builds upon SPF and DKIM as it advises receiving mail servers what to do with emails that fail SPF or DKIM checks.
It can also be useful as it provides reports about your email traffic, which helps identify illegitimate or misconfigured sending services.
Adding a DMARC record is now a requirement for all email senders. Major providers, such as Google and Yahoo, will block ALL emails that come from domains without a DMARC record.
Minimum DMARC Record
To meet the minimum requirement, the DMARC record must have a policy of p=none as a bare minimum. This policy means you are in "monitoring mode". While no actions are being taken it will meet the requirements of the major providers.
To add the record, create a new TXT record in your DNS Zone Editor:
Host / Name: _dmarc
Value / Record Data: v=DMARC1;p=none;
Recommended DMARC Record
While the minimum record meets the compliance requirements, it doesn't provide any feedback. A proper DMARC record should at least include the rua tag to specify an email address for receiving daily aggregate reports.
These reports help to ensure legitimate emails are authenticated correctly. It also reports on any unauthorised use of your domain.
Host / Name: _dmarc
Value / Record Data: v=DMARC1;p=none;rua=mailto:dmarc-reports@yourdomain.com;
About the Reporting Email Address
It is strongly recommended to use a new, dedicated mailbox for DMARC reports (e.g. dmarc-reports@yourdomain.com). Do not use a personal or standard business email address as every major mail provider will send a report every day, which can quickly overwhelm a regular mailbox.
DNS Lookup for DMARC
DMARC records are always _dmarc.yourdomain.com. Tools such as MxToolbox know this and build that into the query when you select DMARC Lookup from the dropdown.
You can also use Command Line tools such as Dig (MacOS / Linux) or Nslookup (Windows):
Dig (MacOS / Linux)
dig _dmarc.yourdomain.com TXT
Nslookup (Windows)
nslookup -type=TXT _dmarc.yourdomain.com
Finalise Setup
Finally, ensure that everything is working as it should.
1. Check with Support
Check with AroFlo Support that all of your DNS records are correct and Email Sending Domains is properly enabled.
2. No Such User Here / Default Address Check
After setting up an email sending domain, you may see the following error on sent emails, especially if you try to send an email to an address in your own organisation:
This usually applies to domains using email solutions provided by their web host, such as those bundled with cPanel.
Mailgun runs recipient/domain validation that fails if there isn’t a valid default address (catch-all).
Setting the default address gives cPanel a fallback, which prevents hard bounces and satisfies Mailgun’s checks.
- From the cPanel Home interface, select Default Address in the Email section.
- Change the option from ‘Discard the email’ to ‘Forward to Email Address’, then enter your preferred email address and click Change.
3. Change the REPLY-TO format
Once your setup is confirmed, the Email Reply Imports Format will need to be changed to ‘Unique REPLY-TO address’.
This is so email that can be replied to (and imported into AroFlo) has the FROM address set to your email address and not an @inboundemail.aroflo.com email address.
When you now email from AroFlo, the FROM address will be your email sending domain email address and the @inboundemail.aroflo.com email address will be copied into the REPLY-TO field.
When the email is replied to, your email address will receive a copy, and the email will be imported into AroFlo.
- Go to Site Administration
- Go to Settings > Email
- For Email Reply Imports Format, use the dropdown to change ‘Unique FROM address only’ to ‘Unique REPLY-TO address’
- Save.
If you receive this warning, it can be safely ignored.
If the email client or program doesn’t respect ‘REPLY-TO’ fields, then when an email is replied to, it will go to your email address, but will not update AroFlo.
While previously high-risk, this is now a rare occurrence, as the RFC which dictates rules surrounding email on the internet requires email clients and programs to support it.
4. Send a test email
With everything completed, it is important to send a test email.
The test email should be sent from an area in AroFlo you intend to regularly email from, for example, Tasks.
- Check the From address is your expected email address
- Send to an email address outside of your organisation
- Send to an email address inside your organisation
- Send an email to the test email address at the website https://www.mail-tester.com to check your mail score.
