← machine room
November 1, 2026Homelab & Hardware5 min read

Email for a personal domain: 90% DNS, 10% praying it isn't spam

There are two universes of “I want to send mail from my own domain.”

Universe A: you’re an enterprise, you run a fleet of servers, and your email delivery is somebody else’s job description.

Universe B: you are one (1) guy with a domain, and you discover that sending a single email from it is a gauntlet of DNS records and stern looks.

I live in Universe B. The vanity address is the easy part — the delivery is where it gets humbling.

The compromise: don’t host the mailbox

Nobody sane runs their own mail server for a personal domain in 2026. The mailbox goes to a provider that takes the abuse on your behalf — in my case a privacy-first one, because of course. Your job shrinks to exactly one thing: making DNS tell the truth about you.

That’s it. That’s the whole game. Four records, one ego.

The four horsemen of deliverability

  1. MX — tells the world where to deliver your mail. Point it at the provider’s servers. Without it, mail for your domain goes into the void and everyone acts surprised.

  2. SPF — a TXT record listing who’s allowed to send. The classic v=spf1 include:... -all. Get this wrong and half the internet gently files your mail into a folder named “probably spam.”

  3. DKIM — a public key the provider signs your mail with. You publish a TXT record containing a selector key. It’s the “I really did send this” handshake.

  4. DMARC — the policy record telling receiving servers what to do if SPF/DKIM fail. p=reject is the confident move; p=quarantine is the cautious one. Either beats nothing, because nothing means “let the AI decide.”

What actually bites people

  • Propagation is not instant. You add records and immediately test, and it fails, and you panic. DNS people — literally the profession of waiting — will tell you to be patient. They’re almost never wrong.
  • SPF with a hard -all and a missing include is the classic “works from the provider but bounces from my own tooling” trap.
  • CNAME can’t sit next to MX on the same name. Some registrars let you think you fixed it. You didn’t.
  • The test that matters is the round-trip: send from [me@ my domain] to another provider, and back, and check the headers for spf=pass, dkim=pass, dmarc=pass. If all three pass, the internet basically has to believe you now.

The grumpy-admin takeaway

Setting up a personal domain’s email isn’t hard — it’s unglamorous, which is arguably worse. No blinking lights, no rack, just a bunch of TXT records that exist to convince machines you’re not a bot. The whole enterprise is begging for permission to send a letter you could hand-deliver faster.

But it works. And when the round-trip comes back and every header says pass, you feel a little flicker of “I have tamed the internet.” It’s the same flicker you get when a rebuild goes green: cheap, fleeting, and absolutely worth it.

Now if you’ll excuse me, I have a DNS cache to flush and a test email to send to myself for the twelfth time. For science.