Connect your domain on Hetzner DNS
Hetzner appends your zone and keeps MX targets literal — the two details that decide whether verification passes.
Hetzner adds your domain to whatever you type
Enter names without your domain — _mailflat-verify, not _mailflat-verify.acme.com. Typing the full name stores it as _mailflat-verify.acme.com.acme.com, and no amount of waiting will make that verify. In the dashboard, keep the Provider dropdown on name only and use the copy button next to each Host.
Where the DNS editor is
- Log in to the Hetzner DNS Console (dns.hetzner.com), or Console → Networking → DNS
- Pick your zone from the list
- Open the Records tab
- Add record
Field names here: Name for the record name, Value for the value, Priority for MX priority.
The five records, as Hetzner wants them
Your real values are on Domains in the dashboard — the verification token and the DKIM key are unique to your domain. Everything else looks exactly like this.
| Type | Name | Value | What it does |
|---|---|---|---|
| TXT | _mailflat-verify | mf-verify-… (yours is in the dashboard) | Proves you own the domain. Verification fails without it. |
| MX | @ | mail.mailflat.net.Priority 10 — Priority | Routes incoming mail to MailFlat. |
| TXT | @ | v=spf1 include:mailflat.net ~all | Authorises MailFlat to send for your domain. |
| TXT | mail._domainkey | v=DKIM1; k=rsa; p=… (yours is in the dashboard) | Signs your outgoing mail. |
| TXT | _dmarc | v=DMARC1; p=none; | Tells receivers what to do when a check fails. |
Keep the trailing dot on the MX value
mail.mailflat.net. ends with a dot on purpose. Hetzner treats a dotless target as relative and appends your domain to it, so mail is routed to a host that does not exist — with no error anywhere. Your domain can verify and still never receive a message.
Hetzner specifics
Hetzner adds your domain for you. Type _mailflat-verify, not _mailflat-verify.acme.com — the full name becomes _mailflat-verify.acme.com.acme.com and nothing will ever verify, no matter how long you wait.
Keep the trailing dot on the MX value. mail.mailflat.net. is the target; drop the dot and Hetzner stores mail.mailflat.net.acme.com — your domain will look configured and still receive nothing.
Priority goes in its own field, never inside the value.
This is the provider that surfaced the bug behind this whole page. If your records are already one level too deep, edit each Name rather than starting over.
Then verify
Back on Domains, press Verify. If it fails, the message says what is actually wrong — including the case where your records landed one level too deep, with the exact name we found them under. DNS changes are usually visible within minutes; a failure that names a wrong record will not fix itself by waiting.
More on custom domains: Custom domains (BYOD).