Add a domain to Mail Hosting

Add the domain your addresses will be on, such as example.com, publish its DNS records and verify it. Once it is verified, it receives mail here and you can create mailboxes and aliases on it.

• A Mail Hosting service with the status active. Order one if you have none. While a service is being set up, Add domain… is greyed out.
• A domain whose DNS you can change. When its zone is on Coritan DNS in the same account, we publish the records for you.
• Room on the plan. The Domains figure on the service's Overview tab shows how many domains it has against the plan's limit. At the limit, the Add a domain page says what raises it (see Troubleshooting).
• A domain that is on no other mail service. A domain can be on one mail service at a time.

1. In the dashboard, go to Mail Services, open the Mail Hosting service, then the Domains tab.
2. Select Add domain…. The Add a domain page opens, at /dashboard/mail/<id>/domains/new. The older address /dashboard/mail/<id>/domains?add=1 goes to the same page.
3. In Domain, enter the domain, such as example.com. Names you claimed under coritan.gg are listed beside Your names:; select one to fill it in.
4. Leave Make this the primary domain ticked if this is the service's main domain. The primary domain names the service in lists. The box starts ticked when the service has no primary domain yet.
5. Select Add domain at the foot of the page. Cancel, or the Domains link above the heading, returns to the Domains tab without adding anything.

The domain's page opens, with its records on the DNS records card. The page keeps what you typed when we refuse the domain, and says why in a Could not add the domain box above the buttons.

The DNS records card groups the records by what they are for:

Needed to receive mail

The ownership record and the MX records. They prove the domain is yours and bring its mail to your mailboxes.

Needed to send mail

The SPF record and the two DKIM records. They let other mail servers trust the mail you send. We verify the domain once these and the records above pass.

Recommended

A backup MX record, the records mail apps set themselves up from, DMARC, MTA-STS and TLS reporting. Mail works without them. The list starts folded: select the button beside its heading, such as Show 11 records, to open it. A recommended record we have not found yet reads Optional.

What you do depends on where the domain's DNS is:

• On Coritan DNS, in this account: nothing. We have already written the records into the zone, and the card reads We publish these into your DNS zone and keep them up to date. By setting up Mail Hosting for a domain you agree that the domain's sending records are managed by us, so a record of yours at an SPF, DKIM or DMARC name is replaced, and the inbox records follow where your MX points. The domain's page lists what we replaced. See Records we publish for you.
• On Coritan DNS, but added to this account after the domain: use the Publish to your zone card on the domain's page.
• A claimed coritan.gg name: nothing. We publish its records and check the domain as soon as you add it.
• Anywhere else: create the records at the company that runs the domain's DNS, as the steps below describe, or move the DNS to us.

To publish the records at another DNS provider:

1. Create the ownership record first: the TXT record at _mailverify.example.com, first under Needed to receive mail. Copy its name and value from the DNS records card.
2. Create the MX records, then the SPF record under Needed to send mail. A domain can have only one SPF record: the value on the card is built from the record your DNS serves now, so it keeps your other senders and adds ours. Replace your record with it.
3. On the domain's page, select Verify now. Once we find the ownership record, we make the domain's two DKIM keys.
4. Reload the page. Needed to send mail now lists the two DKIM records.
5. Create the two DKIM records.
6. Open Recommended and create those records too. They add a backup mail server, let mail apps set themselves up and make the domain harder to fake.

Mail DNS records explains every record and what its check looks for.

While a domain's DNS is somewhere else and the domain is not verified yet, its page has a Host this domain's DNS with us card. Once we host the domain's DNS, the Publish to your zone card adds all the records in one click.

1. Select Add to Domain Management…. The Add a website page opens.
2. Choose Use a domain I already have, and follow Add a domain you already own.
3. Before you change the domain's nameservers, copy the records it already has, such as your website's, to the zone's DNS tab, so they keep working.
4. Come back to the domain's page and select the Publish to your zone card's button.

1. On the domain's page, select Verify now.
2. Read the toast. example.com is verified. means you are done. example.com is still pending: is followed by the first problem the check found.
3. If it is still pending, fix what the Checks row and the The last check found problems list show, and select Verify now again.

We also check pending domains about every ten minutes, so a domain whose records are right verifies on its own. The card's Status column shows each record's result from the last check.

• The domain shows Verified on the Domains tab, and Ownership, MX, SPF and DKIM are ticked. DMARC is shown too, but a domain is verified without it.
• The domain is offered in the Mailboxes and Aliases forms. See Create and manage mailboxes.
• Mail to addresses on the domain arrives here.
• The domain's page shows Ready for mail, with Create your first mailbox… (or Create mailbox… once the service has mailboxes). It opens the Create a mailbox page on the Mailboxes tab.
• The Finish setting up card leaves the service's Overview tab once no other domain is waiting.

The dashboard creates mailboxes only on a verified domain, and a domain verifies only once its MX records point here. To have the mailboxes ready before mail arrives, create them with the API instead: it accepts a domain as soon as its ownership record is found.

1. Add the domain as above.
2. Publish the ownership record, and replace your current SPF record with the value on the card, so the domain keeps one SPF record that holds your senders and ours. Leave your MX records as they are. While the MX points elsewhere, we publish none of the inbox records in a zone on Coritan DNS.
3. Select Verify now. The ownership check passes; the domain stays pending because of MX.
4. Reload the page, then publish the two DKIM records it now lists.
5. Create the mailboxes with the API. See Create and manage mailboxes.
6. Copy the old mail in if you want to. See Move existing mail into a mailbox.
7. Replace your MX records with the ones on the DNS records card, and publish the rest of the list.
8. Select Verify now.

Mail other servers already queued for the old MX hosts can still arrive there for a while after the change, so check the old mailboxes for a few days. Once you no longer send through the old provider, remove its include from your SPF record.

1. Delete the mailboxes and aliases on the domain first. See Delete a mailbox and Forward addresses with aliases.
2. On the Domains tab, select the domain.
3. In the Remove this domain card, select Remove domain….
4. Type the domain name to confirm, then select Remove domain.

The Settings tab has the same Remove domain… button for each domain, under Danger zone. We delete the records we published into your DNS zone. Records at another DNS provider are yours to delete.

Add domain… is greyed out

The service is not active yet. The button turns on once we have set the service up. An address that opens the Add a domain page for such a service shows Add a domain once this service is active in place of the form.

The Add a domain page opens with a box titled This plan allows 3 domains

The service already has as many domains as its plan allows, so Add domain… is greyed out. Remove a domain, or select Open Billing in the box to move to a bigger plan.

The Add a domain page opens with a box titled This plan allows 1 domain and the button See what raises it

On the Mail Hosting your account plan includes, the plan's domains are all used. See what raises it opens a short prompt titled Your plan allows 1 mail domain. It offers the next account plan, such as Upgrade to Pro, and a free trial of it while you can still start one. Each opens its own page: the one that orders the plan, or the one that starts the trial (Change your account plan). Select Not now to close the prompt and stay on the page.

Enter a domain, such as example.com.

The Domain field is empty or is not a domain name. Enter the name alone, without https:// or an address.

Enter a valid domain name such as example.com

The API refused the name. Use letters, digits and hyphens in each label, and a real top-level domain.

Wildcard domains cannot receive mail

Enter a name such as example.com rather than *.example.com.

example.com is already on this service.

The Add a domain page found the name on the service's own Domains tab. Open it there, or enter another name.

That domain is already attached to a mail service

Someone else's mail service has it. If the domain is yours, contact support.

example.com is a sending domain on your SMTP Relay service. To host mailboxes on it, remove it there and give the relay a sending subdomain such as send.example.com.

A domain can be on one mail service. Add a sending subdomain to the relay, remove the domain from the relay, then add it here. The relay can still send as @example.com.

example.com is already on another of your mail services

Remove it from the other Mail Hosting service first.

example.com is a name the mail platform uses itself or example.com is one of the platform's own domains, so it cannot be added to this service

The name belongs to Coritan. Use a domain of your own.

Claim a coritan.gg name before using alex.coritan.gg; it is not yours yet

Claim the name first. coritan.gg is the platform's own domain; claim a name under it first means you entered coritan.gg itself.

This plan allows 1 domain(s)

The plan is full. Remove a domain or move to a bigger plan.

MX points to followed by other hosts

The domain's MX records still name another provider. Replace them with the ones on the DNS records card. When we publish into your zone, we add no MX records while another provider's are there, so delete those yourself.

DKIM selector cor202609r not published

The DKIM record with that selector is missing or holds a different key. Copy the whole value again; some DNS providers split long TXT values, which is fine as long as nothing is lost.

No DKIM keys yet: the mail engine has not made them

We have not finished making the domain's keys. Select Verify now again in a minute.

DMARC publishes p=none, expected p=quarantine

Your DMARC record has a different stage from the one we expect. The domain verifies without DMARC; see DMARC to fix it.

The zone is busy with another change. Check the domain again in a minute.

Another change to the same zone was being saved. Select Verify now again.

Remove the mailboxes and aliases on this domain first

Delete them, then remove the domain.

Sending only

An older domain that passed its checks before MX was required. Its MX records point elsewhere, so it sends but does not receive mail here. Publish the MX records on the card to receive mail.

• Mail DNS records
• Create and manage mailboxes
• How the DMARC stage ramp works
• Mail troubleshooting

Add a domain:

curl -X POST https://api.coritan.com/api/v1/client/mail/4812/domains \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "primary": true}'

domain is the name (3–253 characters) and primary defaults to false. The answer is 201 with the domain and its records, in the shape the records endpoint returns. A name the service refuses answers 400 with one of the messages in Troubleshooting. The coritan.gg claim messages answer 403, and a service that is not active answers 409 Service is not active.

Check the domain now:

curl -X POST https://api.coritan.com/api/v1/client/mail/4812/domains/311/verify \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "domain": { "id": 311, "domain": "example.com", "status": "pending", "checks": { "ownership": true, "mx": false, "spf": true, "dkim": true, "dmarc": true } },
  "result": {
    "ownership": true,
    "mx": false,
    "spf": true,
    "dkim": true,
    "dmarc": true,
    "dmarc_policy": "none",
    "errors": ["MX points to aspmx.example.net"],
    "dkim_pending_published": [],
    "upstream_dkim": null,
    "upstream_spf": null,
    "spf_count": 1,
    "dmarc_count": 1,
    "cname_blocks": [],
    "spf_lookups": 3,
    "resolver_error": false
  }
}

The keys after dkim_pending_published describe the one-record rules:

spf_count, dmarc_count

How many SPF records the domain holds and how many DMARC records _dmarc.example.com holds. Each must be 1 to pass.

spf_lookups

The DNS lookups the SPF record needs. Over 10 fails the check.

cname_blocks

The names that hold a CNAME where a record must go.

upstream_dkim, upstream_spf

Whether our delivery partner's DKIM key and SPF include: are in place. null when the domain's mail does not leave through it.

resolver_error

true when a lookup timed out or was refused. The check then says nothing about your records, and a verified domain stays verified.

The other domain operations:

A domain that is not on the service answers 404 Domain not found.