Skip to main content
When multiple customers share a MailChannels Outbound Filtering account, any sender authenticated to the service could potentially submit mail that claims to be from your domain. Standard SPF records protect your domain on the open internet, but they do not distinguish between different customers within a shared MailChannels deployment. Domain Lockdown closes this gap by letting you declare — in DNS — exactly which MailChannels account IDs and sender IDs are permitted to send from your domain. Any other account that attempts to send from your domain is rejected with an error.

​
How Domain Lockdown works

You publish a DNS TXT record at _mailchannels.yourdomain.com. MailChannels checks this record when processing outbound messages. If the sending account or sender ID is not listed in the record, the message is rejected. If no record exists, MailChannels applies no additional restriction beyond standard authentication.

​
Lockdown identifiers

Domain Lockdown supports two identifier types for Outbound Filtering:
The cfid identifier for Cloudflare Workers is deprecated and will be discontinued. If you are using Outbound Filtering via SMTP relay, use auth and senderid only.

​
DNS TXT record syntax

Create a TXT record at _mailchannels.yourdomain.com using the following format:
You can specify any number of auth and senderid fields in a single record. Each field must carry exactly one value.

​
Examples

Allow a single hosting provider to send from your domain:
Allow two different providers:
Lock down to a specific sender ID:
Allow a provider and a specific sender simultaneously:
Block MailChannels from sending any email from your domain entirely:
Publishing a record with only the version string and no auth or senderid fields instructs MailChannels to reject all messages from your domain, regardless of the sending account.

​
Find your auth and sender ID

Your MailChannels account ID (the value used in auth=) is shown in the panel footer when you log in to the Host Console. Sub-account IDs are listed on the sub-accounts page. You can also read both identifiers from the headers of any message that was successfully sent through MailChannels from the domain you want to lock down:
  • X-MailChannels-Auth-Id — carries the auth value (your hosting provider’s account ID)
  • X-MailChannels-Sender-Id — carries the senderid value (the specific sender entity)

​
Example message headers

In this example, you would use auth=goodhost and/or senderid=goodhost|x-authuser|joe@example.com in your _mailchannels TXT record.

​
Test your lockdown record

MailChannels provides a Python testing script that reads your DNS TXT record and simulates whether a given sender would be accepted or rejected. To use it:
  1. Install the Python DNS library:
  2. Download the script from the GitHub Gist.
  3. Run the script against your domain or a test record string.
Test with a hypothetical record string:
output
Test against a real DNS record:
The script fetches the TXT record from _mailchannels.yourdomain.com and simulates whether the specified auth or senderid value would be accepted. Test a sender ID: Sender IDs contain the | (pipe) character, which most shells treat as a pipe operator. Wrap the entire --test argument in quotes so the shell passes it to the script unchanged:
Without the quotes, zsh or bash splits the value at each | and reports errors such as command not found: x-authuser before the script runs.
After publishing your lockdown record, test it thoroughly before relying on it in production. A misconfigured record can cause legitimate outbound mail to be rejected. Use the testing script to validate your record against every auth and senderid value that should be permitted.
If you manage email for multiple domains, create a _mailchannels TXT record for each domain separately. The record at _mailchannels.example.com applies only to example.com and does not affect example.net or any other domain.