Prompt: set up a domain's mail DNS for a provider (MX, SPF, DKIM, DMARC)
Have an agent wire a zone hosted on ird DNS to a mail provider — Google
Workspace, Microsoft 365, Fastmail, Proton Mail, or values you paste —
with the provider's MX, SPF, DKIM, verification record and client
autodiscovery, plus a DMARC policy rolled out in stages. It reads the
zone first, merges TXT sets instead of clobbering them, and proves each
record with dig before the MX cutover.
Needs: ird access (MCP server or the ird CLI, logged in); the zone on ird DNS (dns_list_zones); the provider's admin console open for the values marked FILL IN; a shell with dig
Costs: record edits are free; the zone bills a tiny amount per record-hour (credits_prices → recurring.dns-zone-hourly)
Group: domains & dns
Paste everything below the line into a fresh conversation. Fill in the
FILL IN block first.
Task
Make ZONE deliver mail through PROVIDER: verification, SPF, DKIM, DMARC
and autodiscovery first, MX last. Plan first; switch MX only when I
say the provider side is ready.
FILL IN
ZONE: example.ro
PROVIDER: google # google | microsoft | fastmail | proton | custom
VERIFY_TXT: FILL IN # domain-verification string from the provider console (blank = none)
DKIM: FILL IN # google: TXT value from Admin console → Gmail → Authenticate email
# microsoft: two selector CNAME targets; proton: three CNAME targets
# fastmail: blank (derived from ZONE); custom: selector=value lines
SPF_ALL: ~all # ~all to start, -all once mail flows only through PROVIDER
DMARC_STAGE: none # none → quarantine → reject; one step per run
DMARC_RUA: dmarc@example.ro # mailbox that receives aggregate reports
CUSTOM: # PROVIDER=custom only: MX/SPF/DKIM/SRV lines as the provider shows them
Non-negotiable rules
- Read, plan, confirm, apply.
dns_get_zone(ZONE) first; show
add / replace / keep with old and new values; wait for yes.
- Merge TXT sets.
dns_set_record replaces the whole record set of
a name+type: an apex TXT call must carry every existing apex TXT
plus the new ones in one texts list. Exactly one string may start
with v=spf1.
- MX is the cutover. Replacing MX moves inbound mail at once; do
it last, after I confirm mailboxes exist at PROVIDER and it is
verified there.
- No invented provider values. MX, SPF includes and autodiscovery
targets are public — confirm them in the provider console, which
wins; DKIM keys and verification tokens are per-account
and come only from FILL IN; blank = skip that record and say so.
- A CNAME stands alone. A DKIM CNAME cannot share its name with a
TXT; delete a stale TXT at that name first.
Steps
A. Read. dns_list_zones must list ZONE (own or delegated).
dns_get_zone(ZONE) (CLI: ird dns records ZONE) → current MX, apex
TXT, _dmarc, *._domainkey, autodiscover, SRV.
B. Build the plan. Names are fully qualified with a trailing dot;
data is typed: MX {preference,
exchange}, TXT {texts:[...]}, CNAME {name}, SRV
{priority, weight, port, target}. Values below are published ones
as of writing; confirm each in the provider console.
- google — MX
1 smtp.google.com.; SPF include:_spf.google.com;
DKIM TXT at google._domainkey (DKIM value, split into ≤255-char
strings); verification TXT at apex
google-site-verification=…; no autodiscovery.
- microsoft — MX
0 <token>.mail.protection.outlook.com.,
<token> = ZONE with dots as hyphens, from the admin center; SPF
include:spf.protection.outlook.com; DKIM CNAMEs selector1._domainkey
and selector2._domainkey → the targets in DKIM; verification TXT at apex MS=ms…; CNAME autodiscover →
autodiscover.outlook.com..
- fastmail — MX
10 in1-smtp.messagingengine.com. and
20 in2-smtp.messagingengine.com.; SPF
include:spf.messagingengine.com; DKIM CNAMEs fm1._domainkey →
fm1.ZONE.dkim.fmhosted.com., same for fm2, fm3; SRV for
_submission._tcp, _imaps._tcp, _pop3s._tcp, _jmap._tcp,
_caldavs._tcp, _carddavs._tcp as the Fastmail console lists
them. No verification token.
- proton — MX
10 mail.protonmail.ch. and 20 mailsec.protonmail.ch.;
SPF include:_spf.protonmail.ch; DKIM CNAMEs protonmail._domainkey,
protonmail2._domainkey, protonmail3._domainkey → the targets in
DKIM; verification TXT at apex protonmail-verification=….
- custom — use CUSTOM verbatim.
All providers: apex TXT v=spf1 <include> SPF_ALL, merged per rule 2;
_dmarc TXT v=DMARC1; p=DMARC_STAGE; rua=mailto:DMARC_RUA (start
quarantine with pct=25).
C. Wait for my confirmation.
D. Apply everything except MX. One dns_set_record(domain=ZONE,
name, type, data) per line (CLI: ird dns set ZONE <name> <type>
<values…>); dns_delete_record only where rule 5 requires it.
E. Verify before cutover. dig +short <type> <name> @<ns> for each
nameserver from dns_get_zone, then @1.1.1.1, for the apex TXT,
_dmarc, every _domainkey name and each SRV/CNAME set. Answers must
equal the plan (public resolvers lag up to the old TTL). Then tell me to
verify and enable DKIM at PROVIDER.
F. Cutover. After my go: set the MX record set, dig +short MX ZONE
on the nameservers, then send a test mail from and to a mailbox on ZONE
— its headers must show spf=pass, dkim=pass, dmarc=pass.
G. DMARC schedule. Name the date to re-run with the next
DMARC_STAGE: quarantine after two weeks of clean reports, reject
after two more.
Deliverable
A table of every mail record now in the zone (name, type, values, TTL,
action), the dig results per nameserver, the test-mail authentication
results, records skipped for a blank FILL IN, and the DMARC next step
with its date.