Author: Robert Devereux

DMARC Records

Domain-based Message Authentication, Reporting, and Conformance (DMARC) records can be used with SPF and/or DKIM records to help protect domains against email spoofing.

A DMARC record is added to DNS as a TXT record. There are 5 key parts to a DMARC record:

  • The Host Name: This is always _dmarc

    The host name is required in a DMARC record
  • The Version Number: This is always v=DMARC1, which means the first version of DMARC.

    The version number is required in a DMARC record
  • The Policy: This tells mail servers what to do if a message fails SPF and/or DKIM checks. The policy can be to reject an email, quarantine and email, or to do nothing. Setting p=reject means messages won’t be delivered if they fail checks. Setting p=none means the receiving mail server can decide what to do. Setting p=quarantine means the mail will get delivered but it will be marked as spam.

    A policy is required in a DMARC record.
  • The Reports Address: This lets you collect statistics on email usage on your domain and how often messages fail SPF and DKIM checks. The general format is rua=mailto:dmarcreport@example.com, where you replace dmarcreport@example.com, with an address that should receive the statistics.

    A Reports address is optional in a DMARC record.
  • The Authentication Methods: You can specify if SPF and/or DKIM should be checked, and whether the checks should apply to sub-domains.

    Authentication methods are optional.

A DMARC record if you only want statistics

You can add this record if you want statistics about email usage without doing anything else.

Host Name: _dmarc
Text: v=DMARC1; p=none; rua=mailto:dmarcreport@example.com

Replace dmarcreport@example.com with an address that should receive reports about messages sent from the domain.

A DMARC record if you want to quarantine mail

You can add this record if you want to quarantine mail that fails checks.

Host Name: _dmarc
Text: v=DMARC1; p=quarantine; rua=mailto:dmarcreport@example.com

You can remove ; rua=mailto:dmarcreport@example.com if you do not want to receive statistics.

Additional Information About DMARC Records

Authentication methods can be SPF, DKIM, or both. The methods also include whether you want Strict matching or Relaxed matching.

Strict matching means the domain in the From address must match the domain in the headers. Relaxed means the domain in the From address can match with the domain or subdomain in the headers. If you send email from name@example.com but the message comes from name@mail.exmaple.com, strict matching will not authenticate the message. Relaxed matching will authenticated the message. If you mail host uses sub-domains, you may want to use relaxed matching.

You can add one type of DKIM matching and/or one type of SPF matching, but you can’t use both relaxed and strict matching for the same type of authentication. Here are some options you can add to your record:

adkim=r;Use DKIM authentication with relaxed matching
adkim=s;Use DKIM authentication with strict matching
aspf=r;Use SPF authentication with relaxed matching
aspf=s;Use SPF authentication with strict matching

You can visit the DMARC FAQ for more detailed information.

DKIM Records

DomainKeys Identified Mail (DKIM) records are a way to authenticate email sent from a domain. DKIM requires setup in DNS and on the sending email server(s).

A DKIM record is added to DNS as a TXT record. The record contains a public digital key. The sending email servers are set up with a private digital key. When an email is sent, the sending server uses the email and the private key to generate a digital signature. The signature is added to the email headers. Receiving email servers verify the digital signature using a public key from the TXT record. If an email has fake headers or has been tampered with, the signature won’t be valid. A separate DMARC record can be used to tell mail servers what to do if the signature isn’t valid.

The sending email server uses a private digital key to generate a digital signature which is added to the email headers. The receiving email server verifies the signature using a public digital key from the DKIM DNS record. If an email has fake headers or has been tampered with, the signature won’t be valid.

How to Add a DKIM Record

Contact your email provider if you want to use DKIM. Your provider will give you a TXT record to add to your domain. The record will have a selector and signature. You can add the record as a TXT record:

  Host Name: selector._domainkey
(replace selector with the selector name provided by your email host)
Text: paste the signature text provided by your email host

The email host will then verify that the record was added. After they verify, they can start using a private key to sign outgoing email from your domain. 

DKIM Records with Pair Networks

If you use Pair Networks for email, you can set up DKIM through the Account Control Center:

  1. Log in to the Account Control Center.
  2. In the left sidebar, click Domains.
  3. In the drop-down, click Manage Your Domain Names.
  4. Click the domain you want to add DKIM to.
  5. Scroll down to the DomainKeys Identified Mail (DKIM) section, and click Change DKIM Settings.
  6. Click Activate DKIM.
    If you use Pair Networks name servers, the records are added automatically and you don’t need to do anything else. You can skip the rest of these steps.
    If you use Pair Domains Custom DNS, you will need to manually add the records.
  7. In a new browser tab, log into the Domain Name Management System.
  8. Click the domain to update.
  9. If Custom DNS is already on, click Edit DNS.
    If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
  10. Click Add New Record
  11. Select TXT from the Add New Record menu
  12. Paste the DKIM Hostname from the Account Control Center into the Host Name box
  13. Paste the DKIM TXT Record Value from the Account Control Center into the Text box
  14. Click Add Record

SPF Records

Sender Policy Framework (SPF) records are a way to authenticate emails sent from a domain. Spam and phishing emails often use fake From and Reply-To addresses to hide the actual senders. An SPF record lists mail servers that are allowed to send email from a domain. If an email is sent from a server that is not listed in the SPF record, the receiving email host knows the message is spam.

An SPF record is added to Custom DNS as a TXT. You want to make sure that any mail servers you use are included in the record. A server missing from the records may cause undelivered mail.

How to Add an SPF Record

Contact your email provider(s) to get their recommended records. If you use multiple providers, all of them need to be combined into a single record.

When you have the information, you can add the record to Custom DNS as a TXT record:

  1. Log into to the Domain Name Management System.
  2. Click the domain to update.
  3. If Custom DNS is already on, click Edit DNS.
    If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
  4. Click Add New Record.
  5. Select TXT from the Add New Record menu.
  6. Enter @ as the Host Name, or leave the field blank.
  7. Enter the SPF record from the into the Text box.
  8. Click Add Record.

SPF Records with Pair Networks

If you use Pair Networks for email, you can create a default SPF record that will include any Pair Networks server that might send email for a domain. You can follow these steps to generate the SPF record:

  1. Log into the Account Control Center.
  2. Click Domains.
  3. Click Manage Your Domain Names.
  4. Click the domain to update.
  5. Click Change SPF Settings.
  6. If you use Pair Networks name servers, you can click Activate SPF to activate the record. Then you can skip the rest of these steps.
    If you use Pair Domains name servers, copy the displayed SPF record.
  7. In a new browser tab, log into to the Domain Name Management System.
  8. Click the domain to update.
  9. If Custom DNS is already on, click Edit DNS.
    If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
  10. Click Add New Record.
  11. Select TXT from the Add New Record menu.
  12. Enter @ as the Host Name, or leave the field blank.
  13. Paste the SPF record from the Account Control Center into the Text box.
  14. Click Add Record.

Please Note: If you use additional email services like mailing lists, you should contact your service provider to find out what additional information might need to be added to the SPF record.

Additional Information About SPF Records

The host name for SPF records is usually @. That means the record is for the domain itself. It affects email from mailbox@example.com. If you want the record to affect email from mailbox@subdomain.example.com, you can enter subdomain as the host name.

The Text field always starts with v=spf1 which means the record uses the first version of SPF. That is followed by a list of servers authorized to send email. The servers may be listed as IP addresses and/or host names. These are the primary ways you can list the mail servers:

MechanismMeaning
athe A record for the domain itself
a:host_namethe A record for host_name
include:host_nameinclude the TXT record for host_name
ip4:ipv4_addressthe specified IPv4 address or addresses
ip6:ipv6_addressthe specified IPv6 address or addresses
mxthe mx record for the domain itself
mx:host_namethe mx record for host_name

There are additional mechanisms, but you are unlikely to use them unless your mail host requests them.

The record ends with a qualifier and the word all. This tells mail servers what to do with messages that come from unauthorized servers.

Using ~all is a soft failure. This means messages that fail SPF checks will be flagged as likely spam but the messages are still delivered.

Using -all is a hard failure. This means message that fail SPF checks will not be delivered.

SPF Lookup Limits

Mail Servers are limited to 10 DNS lookups that can be performed when checking SPF records. It is unlikely that you will encounter this limit, but it is possible.

When checking the SPF record, the IP4 and IP6 mechanisms do not require lookups because they contain the actual IP addresses. Each A, MX, and INCLUDE mechanism will require at least one lookup. Each A requires one to find the IP address of the domain or host name. Each MX requires at least two. The first is to find the mail server(s) listed in the MX record. Then each mail server in the MX record has to be checked to find the corresponding IP address(es). If a domain has multiple MX records, each record needs to be checked and counts as an additional DNS lookup.

Changing Contact Information

If you need to change Registrant (Owner), Admin, Tech, and/or Billing Contacts on your domain(s), you can follow these steps:

  1. Log into the Domain Name Management System.
  2. Click the domain to update.
  3. Click Update Contact Info.
  4. Update the information, and click Submit Changes.

If you want to update the information on multiple domains, you can use a Saved Contact to avoid entering the same information multiple times:

  1. Log into the Domain Name Management System.
  2. Select Saved Contacts from the drop-down navigation menu.
  3. Click Create a New Saved Contact.
    If you already have a Saved Contact, you can skip this step and the next step.
  4. Enter contact information, and click Create.
  5. Click Apply a Saved Contact to Your Domains.
  6. Select the Saved Contact to use.
  7. Check the boxes for the contacts and domains to update.
  8. Click Submit.

Account Contact

You can also change the Account Contact, and apply those changes to the Registrant, Admin, Tech, and/or Billing Contacts for every domain on the account:

  1. Log into the Domain Name Management System.
  2. Select Account Settings from the drop-down navigation menu.
  3. Click Account Contact Information.
  4. Update the information.
  5. Click Update Contact Info.
  6. Review the information, and Click Submit Changes.

After Submitting Changes

Changes to contact information must be approved by the current contact. The Registrant Contact must approve changes to the Registrant, Admin, Tech, and/or Billing Contacts. The Account Contact must approve changes to the Account Contact information. The contact must approve changes within 3 days.

If the email address of any contact is changed, we email the new contact to get approval before we ask the current contact. After the new contact approves, we email the current Registrant Contact or Account Contact. Both the new and current contacts must approve within 3 days.

Verifying .CN Domains

The registry for .CN domains requires registrars to verify the name and identity of the Registrant (Owner) of any .CN domains. Verification must be completed before .CN domains can be renewed. If the verification is not completed, it will not be possible to renew the .CN domain.

The person in the Name field for the Registrant (Owner) must provide us with a copy of a Resident Identity Card (for natural citizens of the People’s Republic of China) or valid passport (for everyone else).

If a Registrant Organization is set, the contact must provide us with a copy of a business license or another organization certificate issued by a government authority. If the document is more than one page, only the first page needs to be submitted. The document must contain the full name of the organization, and it must be an exact match for the Registrant Organization.

The file or files must be in .jpg format with a minimum file size of 100 kB. The maximum file size is 1 MB.

Please contact us for information on providing the file(s).

Using PairSSL with Weebly

If you want your Weebly site to be secure, purchasing an SSL certificate is easy. 

If you are registering a new domain, select the domain(s), check the SSL Certificate and Weebly Site Builder boxes, choose the certificate and Weebly options, and then Proceed to Checkout. After completing the checkout, use the Click here link to set up your new certificate.

If you already have a Weebly site, you can follow these steps to order a certificate:

  1. Log into the Domain Name Management System.
  2. Select SSL Certificates from the drop-down navigation menu.
  3. Select the domain and click Add Certificate.
  4. Select the type of certificate you want, and click Proceed to Checkout.
  5. Enter payment information, read and agree to the Domain Name Registration Agreement, and click Pay Now.
  6. Use the Click here link to set up your new certificate .

Setting Up a Certificate

Setting up the certificate for a Weebly site is almost entirely automatic. We take care of the Certificate Signing Request (CSR) and the Domain Control Validation (DCV), so you just need to select the domain and order:

  1. Under Certificate Purpose, select I want to use this cert with my Weebly site at Pair Domains, select the domain, and click Submit.
  2. Under Key Generation and DCV Selection, you can just click Submit.
  3. Click Order.
  4. Within ten minutes, you should receive an email from us confirming that the certificate has been installed, and your Weebly site is now secure.

Additional Information

A Certificate Signing Request (CSR) is a file that contains information that is used when generating an SSL certificate. It will contain information about the domain name and a public key that is used to encrypt information. When adding SSL to a Weebly site, we automatically generate the CSR. For security reasons, we delete our copy of the private key 30 days after the certificate is issued.

Domain Control Validation (DCV) is used to make sure that the request for a certificate comes from an authorized administrator of a domain. When adding SSL to a Weebly site, we automatically validate by adding a CNAME record to the domain.

If you later decide that you want to use a different domain for your Weebly site, you can reassign the site and the certificate. Please see our Knowledge Base article on how to reassign a Weebly site and our Knowledge Base article on reassigning SSL certificates.

Tax Exemptions

Pair Domains collects Value-Added Tax (VAT) for customers based within the European Union, VAT for customers based in Norway, Goods and Services Tax (GST) for customers based in Canada and Australia, and tax for customers based in the United Kingdom. Future legislation may require us to collect taxes for other locations.

Collection of taxes is based on the location of the Account Contact for an account.

Customers based in locations where we collect tax can provide documentation of a tax-exempt status. The tax-exempt status will need to be verified. If verified, we will not charge tax on orders. You will be responsible to declare the purchases and pay any applicable taxes.

Customers based in the European Union or Norway can provide a VAT ID, and we will not collect VAT.

Customers based in Australia can provide an Australian Business Number (ABN), and we will not collect GST.

Customers based in Canada can provide a Business Registration Number (BRN), and we will not collect GST.

Customers in other locations can provide a PDF that documentations of the tax-exempt status.

You can follow these steps to provide documentation of tax-exempt status:

  1. Log into the Domain Name Management System.
  2. Select Account Settings from the drop-down navigation menu.
  3. Click Tax Settings.
  4. Enter the VAT number, ABN or BRN, and click Add.
    If you are not prompted for a number, you can upload a PDF that demonstrates tax-exempt status, and click Request Exemption.
  5. We will email you after we verify the number or document.

Tax rates that we charge are based on rates available to us, and may not necessarily reflect the rate that is appropriate for your particular filing status. It is your responsibility to ensure that taxes are paid in full.

Replacing or Reassigning a Certificate

An SSL certificate can be reassigned to another domain. This is called Replacing a certificate, and it involves setting up the certificate again, including choosing the domain, CSR, and DCV.

Replacing a certificate will not change the expiration date of the certificate. The expiration date will always be based on the date the certificate was originally issued.

You can follow these steps to replace a certificate:

  1. Log into the Domain Name Management System.
  2. Select SSL Certificates from the drop-down navigation menu.
  3. Click Manage for the certificate you want to replace.
  4. Click Replace Certificate.
  5. Select the Certificate Purpose, and click Submit.
  6. Select if you want us to generate the Certificate Signing Request, or if you want to upload your own.
  7. Select if you want us handle Domain Control Validation, or if you want to manage your own DCV.
  8. Click Submit.
  9. Click Order.
  10. Check your email for a message from us telling you Your certificate is ready for download.

Ordering an SSL Certificate

Certificates can be ordered during your domain name registration or they can be ordered for domains that are already registered.

You can follow these steps to order for an already registered domain:

  1. Log into the Domain Name Management System.
  2. Select SSL Certificates from the drop-down navigation menu.
  3. Select the domain and click Add Certificate.
  4. Select the type of certificate you want, and click Proceed to Checkout/
  5. Enter payment information, read and agree to the Domain Name Registration Agreement, and click Pay Now.
  6. Use the Click here link to set up your new certificate .

Setting Up a Certificate

When you set up a certificate, you will be asked a few questions. First, you will be asked how you want to use the certificate.

If you want to use it on a domain that is already registered with us, you can select I want to use this cert with a domain at Pair Domains, and then choose the domain or sub-domain.

If you want to use the certificate with a Weebly site with Pair Domains, you can select  I want to use this cert with my Weebly site at Pair Domains, and then select the site name.

You can also use a certificate with a domain that is registered someplace else.

After selecting the purpose of the certificate, you will be asked if you want us to generate a certificate signing request (CSR) or if you want to upload your own CSR. For most customers, we recommend letting us generate the CSR.

After the CSR, you will be asked if you want us to handle the domain control validation (DCV), or if you want to handle it yourself. DCV is a way to confirm you are authorized to buy a certificate for a domain. If you use Pair Domains Custom DNS and/or a Weebly site with Pair Domains, we recommend letting us handle DCV automatically. If you use pair.com name servers, we recommend purchasing the certificate directly through the Account Control Center. That will let the validation be completed automatically.

If you host a domain elsewhere, you can manage your own DCV. You can choose I want to manage my own DCV option, and then specify whether you want to validate by creating a CNAME record, uploading a text file, or emailing a link to validate.

After choosing the validation method, the order can be submitted to our certificate authority, Sectigo. After they the validate the domain, they send the certificate to us, and we will email you to let you know the certificate has been received. You can log into your account and download the certificate files. If you are using a Weebly plan with us and let us handle the CSR and DCV, you don’t need to download anything. We will automatically install the certificate.

If a domain is hosted with Pair Networks, we recommend purchasing the certificate directly through the Pair Networks Account Control Center. That will let the certificate be installed automatically.

If a domain is hosted elsewhere, you will need to download copies of the certificate file, the private key (if we generated it for you), and the certificate chain. These files can then be installed on your web server.

About Domain Control Validation (DCV)

Domain Control Validation (DCV) is used to make sure that the request for a certificate comes from an authorized administrator of a domain. Validation can be made in one of these ways:

  1. Creating a CNAME record on the domain.
  2. Uploading a text file to the website for a domain.
  3. Emailing an address on the domain.

If you use Pair Domains name servers, we can automatically handle DCV by adding the CNAME record to the domain.

If you use pair.com name servers, we recommend purchasing the certificate directly through the Account Control Center. That will let the validation be completed automatically.

If you host a domain elsewhere, you can manage your own DCV. You can choose the I want to manage my own DCV option, and then specify whether you want to validate by creating a CNAME record, uploading a text file, or emailing a link to validate.

Positive Wildcard certificates can only be validated with a CNAME record or by email. Uploading a file to the website is not an option.