Connect your domain on Gandi
Gandi appends your zone to record names and keeps MX targets literal — the trailing dot decides whether mail ever reaches you.
Gandi adds your domain to whatever you type
Enter names without your domain — _mailflat-verify, not _mailflat-verify.acme.com. Typing the full name stores it as _mailflat-verify.acme.com.acme.com, and no amount of waiting will make that verify. In the dashboard, keep the Provider dropdown on name only and use the copy button next to each Host.
Where the DNS editor is
- Log in to Gandi
- Domain list → your domain
- DNS Records tab
- Add record
Field names here: Name for the record name, Value for the value, Priority for MX priority.
The five records, as Gandi wants them
Your real values are on Domains in the dashboard — the verification token and the DKIM key are unique to your domain. Everything else looks exactly like this.
| Type | Name | Value | What it does |
|---|---|---|---|
| TXT | _mailflat-verify | mf-verify-… (yours is in the dashboard) | Proves you own the domain. Verification fails without it. |
| MX | @ | mail.mailflat.net.Priority 10 — Priority | Routes incoming mail to MailFlat. |
| TXT | @ | v=spf1 include:mailflat.net ~all | Authorises MailFlat to send for your domain. |
| TXT | mail._domainkey | v=DKIM1; k=rsa; p=… (yours is in the dashboard) | Signs your outgoing mail. |
| TXT | _dmarc | v=DMARC1; p=none; | Tells receivers what to do when a check fails. |
Keep the trailing dot on the MX value
mail.mailflat.net. ends with a dot on purpose. Gandi treats a dotless target as relative and appends your domain to it, so mail is routed to a host that does not exist — with no error anywhere. Your domain can verify and still never receive a message.
Gandi specifics
Gandi adds your domain for you. @ is the root.
Keep the trailing dot on the MX value (mail.mailflat.net.) — without it Gandi appends your domain to the target.
Gandi also offers a text editor for the whole zone; if you use it, the same two rules apply.
Then verify
Back on Domains, press Verify. If it fails, the message says what is actually wrong — including the case where your records landed one level too deep, with the exact name we found them under. DNS changes are usually visible within minutes; a failure that names a wrong record will not fix itself by waiting.
More on custom domains: Custom domains (BYOD).