OquMail
Get started
Loading account…
DNS & Setup3 min readUpdated

Gandi DNS for Business Email: Replace the Pre-set Mail Records

Add the four email DNS records on a Gandi domain: the LiveDNS page, deleting the default spool and fb MX records, editing the pre-set SPF, and verification.

A Gandi domain comes with a DNS zone already prepared for Gandi's own mail service: two MX records pointing at spool.mail.gandi.net and fb.mail.gandi.net, an SPF record that includes _mailcust.gandi.net, and a webmail CNAME. Using a mailbox on your domain elsewhere means replacing those records rather than adding beside them, and that is where most Gandi setups go wrong. This guide works through the LiveDNS page in the right order.

Quick answer

Gandi, Domain, click the domain, DNS Records. Delete the two MX records pointing at mail.gandi.net hosts and edit the existing SPF TXT to v=spf1 mx a:mail.oqumail.com ~all. Add an MX with Name @, priority 10, hostname mail.oqumail.com. Add TXT records at the DKIM selector and at _dmarc. Click Verify in OquMail.

The four records

  • MX: host blank or @, value mail.oqumail.com, priority 10
  • SPF: TXT at the root, value v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com ~all
  • DKIM: TXT at the selector name shown in your OquMail dashboard, ending in ._domainkey, with the key value from the dashboard
  • DMARC: TXT at _dmarc, value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com (use your own address)

Step by step

  1. Log in at admin.gandi.net, open Domain in the left menu and click the domain.
  2. Open the DNS Records tab. If the domain uses external nameservers, the Nameservers tab says so and the records belong at that provider.
  3. Find the MX records with hostnames spool.mail.gandi.net and fb.mail.gandi.net and delete both.
  4. Find the TXT records (short text lines in DNS used for email security) at @ starting v=spf1 and edit it. Replace the value with v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com ~all. Do not add a second SPF record.
  5. Click Add, Type MX, Name @, TTL 10800 (or lower), Priority 10, Hostname mail.oqumail.com. Create.
  6. Add, Type TXT, Name the DKIM selector exactly as the OquMail dashboard shows it (ending in ._domainkey, without the domain), Value the key. Gandi adds the quotes itself. Create.
  7. Add, Type TXT, Name _dmarc, Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, using an address you read. Create.
  8. If Gandi mailboxes exist on the domain under the Email tab, export anything you need and deactivate them, so nothing keeps accepting mail at Gandi.
  9. Back in the OquMail dashboard, click Verify.

Free business email on your own domain

OquMail gives you up to 15 mailboxes on your domain — free — with guided SPF/DKIM/DMARC, webmail, IMAP/SMTP for any mail app, and a send API. Setup is a few DNS records; changes usually take effect within minutes, occasionally up to 48 hours. Start at oqumail.com.

Get started free

Gandi quirks

  • The default records exist on every new domain whether or not you ever used Gandi mail; they must go, or receivers will see two providers in your MX.
  • Gandi wraps TXT values in quotes in the editor. Paste the value plain; typing quotes produces doubled quotes and a broken record.
  • Long DKIM values are split into 255-character strings automatically; that is correct and resolvers join them.
  • The default TTL is 10800 seconds (three hours). Lower it to 300 on the new records while you set up, so corrections are quick.
  • The webmail and IMAP (a method to read business email in Outlook, Apple Mail, or Thunderbird) CNAME records pointing at Gandi hosts are harmless and can be deleted for tidiness.

Confirm it works

Click Verify in the OquMail dashboard; the live check names any record still missing or mistyped. Then run the domain through the free MX lookup, SPF checker and DMARC checker, and send a message from webmail to a Gmail address, checking Show original for spf=pass and DKIM (a digital signature that proves your email was not tampered with)=pass. Changes usually take effect within minutes, occasionally up to 48 hours.

Common questions

Can I keep Gandi mailboxes and use OquMail for other addresses?

Not on the same domain. MX records send every address to one provider. Move all addresses, or put the second provider on a subdomain.

Verify says SPF is missing although the record is there.

Usually two v=spf1 records exist, the old Gandi one and a new one. Receivers treat that as no record. Keep one; see more than one SPF record.

My zone is on Gandi's old (classic) DNS.

Migrate to LiveDNS from the Nameservers tab first; the classic zone editor is retired and the steps above assume LiveDNS.

Want to see how your own domain is set up? Use the free SPF checker, DMARC checker and MX lookup: they run in your browser and store nothing.

Related articles