.png&w=3840&q=75)
Email3 min
How to Authenticate Third-Party SMTP Services via DNS
NS
NameSilo Staff9/10/2026
Share
To authenticate a third-party SMTP service like Mailgun or SendGrid, you must authorize their servers inside your domain's DNS. The service will provide unique CNAME, MX, and TXT (SPF/DKIM) records. Copy these generated strings and paste them into your domain registrar's advanced DNS manager to prove you own the domain and authorize outbound delivery.
What Is an SMTP Relay?
An SMTP relay is a third-party service that handles sending on your application's behalf, absorbing the infrastructure burden of transactional mail: password resets, receipts, notifications, often tens of thousands per month. Instead of your own server managing delivery, retries, and reputation, a specialized provider does it at scale.
DNS authentication is what proves to that provider, and to every receiving mail server, that you actually control the domain being used to send.
Why It Matters: Avoiding the Spam Fold
Since February 2024, Gmail and Yahoo enforce bulk sender rules requiring proper authentication. An unauthenticated relay setup gets folded into spam or rejected outright at volume, regardless of how well-written the emails are. For an app sending 50,000 password resets a month, that's 50,000 support tickets waiting to happen if authentication isn't configured correctly from day one.
The Subdomain Strategy
Never authenticate your root domain directly for transactional mail. Map the relay service to a dedicated subdomain instead, such as mg.yourbrand.com for Mailgun, or the auto-generated subdomain SendGrid assigns (typically a random string like em123.yourbrand.com).
This isolation matters because transactional and marketing mail carries different risk than your primary corporate inbox. If the relay subdomain ever takes a reputation hit from a spike in bounces or spam complaints, your root domain's own email, the one your team actually uses daily, stays completely unaffected.
Implementation Steps
Mailgun requires two TXT records (SPF and DKIM) at minimum for verification. MX records (mxa.mailgun.org, mxb.mailgun.org) and a tracking CNAME are optional, only needed if Mailgun should receive inbound mail or track opens/clicks.
SendGrid works differently: with Automated Security enabled, it generates three CNAME records, two for DKIM key rotation and one for the return path. SendGrid manages the underlying values remotely, so once the CNAMEs are in place, you never need to touch DNS again for key rotation.
To add these at NameSilo:
- Log into NameSilo and go to Domain Manager
- Click the blue globe icon next to your domain to open DNS Manager
- Click Add New DNS Record for each entry the provider supplied
- Set the Host field to exactly what's shown (often just the subdomain portion, not the full domain)
- Paste the Value field exactly, character for character
- Save, allow 15-20 minutes for records to propagate, then return to Mailgun or SendGrid and click Verify
Common Mistakes
Replacing your primary root domain's MX records with the relay's MX records: This is the single most damaging mistake possible here. If your business already receives mail through Google Workspace or another provider at the root domain, adding a relay's MX records there redirects all incoming corporate email away from your actual inbox instantly.
Leaving a CNAME behind a proxy: If your DNS is managed through a provider offering proxying (like Cloudflare's orange cloud), these authentication CNAMEs must stay in DNS-only mode. A proxied CNAME breaks verification entirely.
What This Means for You
Configure and verify your transactional mail subdomain directly through NameSilo's DNS Manager, keeping your root domain's mail, and your NameSilo Email inbox, completely untouched by third-party relay traffic.
Frequently Asked Questions
What is an SMTP relay service? A third-party provider that sends email on your application's behalf at scale.
How do I authenticate SendGrid in DNS?
Add the CNAME records SendGrid provides, typically three under Automated Security.
Why do I need a subdomain for Mailgun?
To isolate transactional sending reputation from your primary corporate email.
What are CNAME tracking records for email?
Optional records enabling open and click tracking on sent messages.
Does NameSilo support Mailgun and SendGrid?
Yes, both authenticate through standard TXT and CNAME records in DNS Manager.
Will setting up an SMTP relay break my normal email?
Only if you mistakenly replace your root domain's existing MX records.
How long does SMTP DNS verification take?
Often minutes once records propagate, though it can take longer in some cases.
What is transactional email?
Automated, individually triggered messages like receipts, resets, and confirmations.
.png&w=2048&q=75)
NameSilo StaffThe NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
More articleswritten by NameSilo
.png&w=3840&q=75)
.png&w=3840&q=75)