Skip to main content
When multiple customers share a MailChannels Outbound Filtering account, any sender authenticated to the service could potentially submit mail that claims to be from your domain. Standard SPF records protect your domain on the open internet, but they do not distinguish between different customers within a shared MailChannels deployment. Domain Lockdown closes this gap by letting you declare — in DNS — exactly which MailChannels account IDs and sender IDs are permitted to send from your domain. Any other account that attempts to send from your domain is rejected with an error.

​
How Domain Lockdown works

You publish a DNS TXT record at _mailchannels.yourdomain.com. MailChannels checks this record when processing outbound messages. If the sending account or sender ID is not listed in the record, the message is rejected. If no record exists, MailChannels applies no additional restriction beyond standard authentication.

​
Lockdown identifiers

Domain Lockdown supports two identifier types for Outbound Filtering:
The cfid identifier for Cloudflare Workers is deprecated and will be discontinued. If you are using Outbound Filtering via SMTP relay, use auth and senderid only.

​
DNS TXT record syntax

Create a TXT record at _mailchannels.yourdomain.com using the following format:
You can specify any number of auth and senderid fields in a single record. Each field must carry exactly one value.

​
Examples

Allow a single hosting provider to send from your domain:
Allow two different providers:
Lock down to a specific sender ID:
Allow a provider and a specific sender simultaneously:
Block MailChannels from sending any email from your domain entirely:
Publishing a record with only the version string and no auth or senderid fields instructs MailChannels to reject all messages from your domain, regardless of the sending account.

​
Find your auth and sender ID

Every message routed through MailChannels includes two headers that carry the identifiers you need:
  • X-MailChannels-Auth-Id — carries the auth value (your hosting provider’s account ID)
  • X-MailChannels-Sender-Id — carries the senderid value (the specific sender entity)
To find these values, examine the raw headers of any message that was successfully sent through MailChannels from the domain you want to lock down.

​
Example message headers

In this example, you would use auth=goodhost and/or senderid=goodhost|x-authuser|joe@example.com in your _mailchannels TXT record.

​
Test your lockdown record

MailChannels provides a Python testing script that reads your DNS TXT record and simulates whether a given sender would be accepted or rejected. To use it:
  1. Install the Python DNS library:
  2. Download the script from the GitHub Gist.
  3. Run the script against your domain or a test record string.
Test with a hypothetical record string:
output
Test against a real DNS record:
The script fetches the TXT record from _mailchannels.yourdomain.com and simulates whether the specified auth or senderid value would be accepted.
After publishing your lockdown record, test it thoroughly before relying on it in production. A misconfigured record can cause legitimate outbound mail to be rejected. Use the testing script to validate your record against every auth and senderid value that should be permitted.
If you manage email for multiple domains, create a _mailchannels TXT record for each domain separately. The record at _mailchannels.example.com applies only to example.com and does not affect example.net or any other domain.