Domain verification with Mandrill

This article explains how to complete a domain verification process so that ChurchSuite can send emails using your organisation's verified domain, rather than sending via ChurchSuite's verified domain. Domain verification, in both contexts, increases email security and deliverability.

Overview of domain verification

Domain verification is best explained with an example. Imagine sending an email through ChurchSuite from a personal Hotmail address. Each recipient's email provider will know that the email didn't originate from the Hotmail email server - it originated from ChurchSuite's email server. The practice of sending an email purporting to be from another person or organisation's domain is called 'spoofing' and it's this disparity that increases the risk of recipient email providers marking emails as spam, or rejecting the emails entirely and will adversely affect the true sender's domain reputation. Domain verification is a process that authorises ChurchSuite to legitimately send emails through our email servers on behalf of the verified domain.

In the remainder of this article, we explain how existing Mandrill integration customers can verify additional domains - it's only possible to verify a domain that you own and manage:

Stage 1 - enter your email address

Begin by entering a valid Email Address for the domain being verified. Click Save and Proceed. Now check your email inbox - Mandrill Client Services sends a domain verification email that must now be forwarded to us at support@churchsuite.com, so that we can verify your domain name with Mandrill - the content of that email is not something that you can action. If the email doesn't arrive, check your spam folder - the email comes from help@mandrill.com. Each Mandrill verification email causes all previously requested emails to expire, so you must send us the latest email version that you receive.

Stage 2 - forward your Mandrill email to ChurchSuite Support

This stage involves confirming that you have forwarded the Mandrill Client Services email to ChurchSuite Support. Once we receive that email and process it, we'll send a confirmation email to you confirming that you can proceed to the final stage. You can now tick the box in Stage 2 and click Save and Proceed.

Stage 3 - configure the SPF and DKIM records in your DNS settings

This stage can be trickier as it requires a little technical know-how and access to the DNS settings for your domain - typically accessed through some sort of control panel or dashboard. Essentially you are going to add two new text records (TXT) to your DNS. Once logged in to your domain provider account, navigate to the advanced DNS settings. Follow your domain host's instructions for adding the following two DNS records. Your domain host will provide support articles on how to add DNS records; alternatively, you may wish to reach out to their online support for help with this.

DNS Record #1: Add a DKIM record to your domain name

A DKIM record authorises an email service to send out emails on behalf of your domain name, in this case, it authorises ChurchSuite to send out emails from your @yourdomainname.org.

You will need to create a new TXT record for mandrill._domainkey.yourchurchdomain.com (where yourdomainname.com is your organisation's domain name). Note that some host providers will automatically append your domain name to a DNS record, so you may need to add in the prefix part, i.e. mandrill._domainkey

For this TXT record add the following TXT 'value' (be sure to copy and paste the full value from the box below - it ends with a semicolon)...

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrKsn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKynO8/lQIDAQAB;

DNS Record #2: Add an SPF record to your domain name

An SPF record is similar to a DKIM record in that it authorises emails to be sent out from your domain name by a third-party service.

You will either create a new SPF record or edit an existing SPF record. Your DNS can only have one SPF record. The SPF record will need the following value (be sure to copy and paste the full value below):

v=spf1 include:spf.mandrillapp.com ?all

Note: Most domain hosts do not require a hostname to be entered for SPF - the text value above is sufficient. If an entry is required in the hostname field, try entering just the @ symbol (which symbolises your root domain name), or enter your domain name in full.

If you have an existing SPF record, with an existing value, perhaps with other 'include' statements, you only need to edit the existing record and add include:spf.mandrillapp.com before the final all statements - be careful not to overwrite any of the existing 'include' statements - just append include:spf.mandrillapp.com before the final all.

Note that you can only have one SPF record in DNS. If your SPF entry isn't being recognised as valid, check that you don't have more than one SPF record! While you might have multiple DKIM records, you should only have one SPF record in your DNS.

It can sometimes take a few hours for DNS changes to propagate. However, if you've done everything correctly then the Mandrill integration will show four green ticks and the progress bar will be 100% green. You can safely navigate away from the page - you're all done and your domain has been verified!

If you have more than one domain to verify - perhaps because your organisation sends emails through more than one email domain name, you can click Add another domain and repeat Stage 1. ChurchSuite tracks the progress of each domain's verification through each stage.