Living alongside another provider

Almost nobody arrives here from nothing. There is a previous provider, there is the company's own mail server, and things are going out through both. None of that has to stop.

The rule that causes trouble

SPF is the one place where providers collide, because a domain may have only one SPF record. If you publish ours next to the one you already have, you end up with two, and receivers start ignoring both: to them, two records are a misconfiguration rather than a longer list.

The panel detects that. When a record already exists, instead of showing ours on its own it shows you the merged record:

Right now
v=spf1 include:_spf.google.com ~all

Should become
v=spf1 include:_spf.google.com include:spf.c-connect.pt ~all

You publish that one, replacing the old. Google stays authorised, we are added, and there is a single record.

DKIM and DMARC do not collide

DKIM lives under a selector, and every provider has its own. Ours are cs1._domainkey and cs2._domainkey (or a dated one if you publish the key yourself), your previous provider's will be something else; they can coexist indefinitely, and each message is checked against the selector it names itself.

DMARC is a single record, but it serves the whole domain rather than one provider. If you already have one, do not replace it: add our reporting address to the rua that is already there, separated by a comma.

v=DMARC1; p=none; rua=mailto:dmarc@yourprovider.com,mailto:dmarc@dmarc.c-connect.pt

A subdomain solves nearly all of it

The advice to use mail.company.com rather than company.com is not cosmetic. A subdomain has its own zone of records, so:

• the subdomain's SPF is only ours, and there is nothing to merge;
• people's own mail, which leaves the main domain, is untouched;
• the reputation of automated sending does not mix with that of the mailboxes.

If you can do it that way, do. The sections above are for those who really do have to send from the root domain.

Moving traffic gradually

You do not have to switch everything at once. Once the domain is verified you can:

1. send one kind of message first, receipts for example;
2. watch the delivery rate and the bounces in the panel for a few days;
3. add the rest once the numbers are where you expect.

Meanwhile the previous provider keeps working: both are authorised in the same SPF, and each message is signed by whoever sends it.

What to check before switching the old one off

• Bounces are arriving. In Messages, check that statuses move past Accepted.
• The DMARC reports already show our sending aligned.
• No internal system is still pointing at the old SMTP. It is the most common reason somebody discovers weeks later that one notification stopped going out.