Email & SMTP setup

Send transactional and broadcast email through MsgHub using your own SMTP server or transactional ESP. This guide covers picking a provider, configuring DKIM/SPF/DMARC (the three DNS records every modern email program needs), connecting MsgHub, and tuning for deliverability.

Overview

MsgHub doesn't run its own bulk email infrastructure — instead it plugs into your email service. This means you own the sender reputation, your customers see your real domain, and you can switch providers without changing anything in MsgHub.

MsgHub Settings exposes three provider options:

• SMTP — generic SMTP relay. Works with any service that speaks SMTP: Google Workspace, Hostinger / cPanel email, Zoho Mail, AWS SES (via its SMTP interface), Postmark (via SMTP), Brevo, ZeptoMail, your own mail server, etc.
• SendGrid — uses the SendGrid Web API. Just paste an API key.
• Mailgun — uses the Mailgun Web API. Paste API key + sending domain + region (US / EU).

Five things to get right:

1. Pick a provider — SMTP / SendGrid / Mailgun.
2. Get credentials from the provider.
3. Add three DNS records (SPF, DKIM, DMARC) to authenticate your domain.
4. Paste credentials in MsgHub Settings → Email Configuration.
5. Save and send a test email.

Prerequisites

• An active MsgHub tenant account.
• A domain you own with access to its DNS panel (Cloudflare, Route 53, Godaddy, Hostinger, etc.).
• ~30 minutes active time, plus DNS propagation wait (usually 5–60 min).

Pick a provider

In MsgHub Settings, choose SMTP, SendGrid, or Mailgun. The most common service providers — and which MsgHub option to use for each:

DKIM, SPF, DMARC — the three records that prevent spam folder

Email authentication is essentially three DNS records that tell receiving mail servers: "This sender really is authorised to send for this domain." Without them, modern Gmail / Outlook / Yahoo treat your email as suspicious.

SPF (Sender Policy Framework)

Lists which IP addresses or providers can send email from your domain. One TXT record per domain.

# DNS record
Type:  TXT
Host:  @           # or your domain
Value: "v=spf1 include:_spf.google.com include:amazonses.com ~all"

Include directive depends on provider:

Combine multiple in one record (max one SPF record per domain is the rule):

v=spf1 include:_spf.google.com include:amazonses.com ~all

DKIM (DomainKeys Identified Mail)

Cryptographic signature on every outbound email. Your provider gives you a public key as a TXT record. Receiving servers verify each email.

Each provider has its own DKIM record format. Examples:

# Workspace
Type:  TXT
Host:  google._domainkey
Value: "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

# AWS SES (after creating verified identity, SES gives 3 CNAME records)
Type:  CNAME
Host:  {token1}._domainkey.yourdomain.com
Value: {token1}.dkim.amazonses.com

Each provider's dashboard generates the exact records to add — copy-paste verbatim.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Tells receiving servers what to do when SPF/DKIM fail, and gives you a reporting email for failures.

# Start in monitoring mode for 2 weeks, then tighten
Type:  TXT
Host:  _dmarc
Value: "v=DMARC1; p=none; rua=mailto:[email protected]; pct=100"

Policy values:

• p=none — monitor only. Start here for 2 weeks.
• p=quarantine — failed auth goes to spam. Use after 2 weeks if reports look clean.
• p=reject — failed auth is bounced. Strictest. Required to be a "Verified Sender" in Gmail's eyes.

Setup: Google Workspace SMTP relay

1. Workspace Admin Console → Apps → Google Workspace → Gmail → Routing → SMTP relay service → Add.
2. Allow senders: Only registered addresses in your domain. Require TLS encryption: Yes. Require SMTP authentication: Yes.
3. Save. The relay endpoint is smtp-relay.gmail.com:587.
4. Username = a Workspace user (e.g. [email protected]). Password = an App Password generated for that user (regular Google password won't work).
5. Add SPF: v=spf1 include:_spf.google.com ~all.
6. Generate DKIM: Admin Console → Apps → Gmail → Authenticate email → Generate new record → copy the TXT record into your DNS → wait 5 min → click Start authentication.

Setup: AWS SES

1. AWS Console → SES → pick a region (use ap-south-1 for India audience for lowest latency).
2. Verified identities → Create identity → pick Domain → enter your domain → Easy DKIM with RSA 2048-bit.
3. SES gives you 3 CNAME records — add to your DNS. Verification takes 1–30 minutes.
4. By default SES is in sandbox mode — can only send to verified addresses. To go production: Account dashboard → Request production access. Approval usually within 24 hours; needs a clear use-case description.
5. Create SMTP credentials: SMTP settings → Create SMTP credentials. Copy the IAM-derived username/password.
6. SMTP endpoint: email-smtp.{region}.amazonaws.com:587.
7. SPF: v=spf1 include:amazonses.com ~all.

Setup: SendGrid

1. SendGrid dashboard → Settings → Sender Authentication → Authenticate Your Domain.
2. Pick your DNS host. SendGrid generates 3 CNAME records (DKIM + return-path) — add to DNS.
3. Click Verify. Usually green in 5–30 minutes.
4. Create an API key: Settings → API Keys → Create API Key → Restricted Access → grant Mail Send full access. Copy the key.
5. SMTP endpoint: smtp.sendgrid.net:587. Username: literally apikey. Password: the API key.
6. SPF: v=spf1 include:sendgrid.net ~all.

Setup: Hostinger / cPanel SMTP

Bundled with most shared-hosting plans. Works for low-volume transactional. Don't use for marketing — hard rate limits.

1. Hostinger panel → Emails → Email Accounts.
2. Create a mailbox (e.g. [email protected]). Set a strong password.
3. Login to Webmail at least once from the panel — first login activates the mailbox. Skipping this causes EAUTH 535 Authentication failed later.
4. SMTP endpoint: smtp.hostinger.com:465 (SSL) or :587 (TLS).
5. Username: full email address. Password: mailbox password.
6. SPF: v=spf1 include:_spf.mail.hostinger.com ~all.
7. DKIM: Hostinger panel → Emails → Email Configuration → DKIM & SPF → enable. Copy the generated TXT to DNS if Hostinger isn't your DNS provider.

Connect to MsgHub

Send a test email

Authentication-Results: mx.google.com;
  spf=pass [email protected];
  dkim=pass [email protected];
  dmarc=pass action=none header.from=yourdomain.com

Deliverability tips

1. Warm up new IPs gradually. If your provider gives you a dedicated IP, send 50 emails day 1, 100 day 2, doubling daily. Skipping warm-up gets you instant spam-folder.
2. Match From name and content style. Customers should recognise the brand instantly. Generic noreply@ hurts engagement; support@ or orders@ is friendlier.
3. Don't mix transactional and marketing on the same domain. Use orders.yourdomain.com for transactional (high trust required), news.yourdomain.com for marketing (lower stakes if reputation tanks).
4. Add a real unsubscribe link to every marketing email. Required by law (CAN-SPAM, GDPR, India DPDP) and ranking signal for Gmail.
5. Keep complaint rate under 0.1%. Above 0.3% gets you suspended by every major ESP.
6. Clean bounces and complaints from your list immediately. MsgHub auto-suppresses hard-bounces; soft-bounces retry then auto-suppress after 5 failures.
7. Don't buy email lists. Permission-based lists outperform bought lists 10× and won't tank your reputation.
8. Monitor Postmaster Tools. Gmail Postmaster (postmaster.google.com) shows your domain reputation. Aim for High; Bad means you're in trouble.

Troubleshooting

"EAUTH 535 Authentication failed"

• Hostinger-specific: mailbox was never logged into via Webmail. Login once, then retry.
• Wrong password — using your account login instead of an app password / API key.
• 2FA enabled on Workspace user — need an App Password, not the regular password.
• API key was regenerated and the old one is in MsgHub. Re-paste.

"Connection refused" on port 587

• Provider doesn't support 587 — try 465 with SSL.
• Your server's outbound firewall blocks SMTP. Whitelist your ESP's IP range.
• Some ISPs block 25/465/587 outbound by default — known issue with consumer-grade hosting.

Emails land in spam despite passing DKIM/SPF/DMARC

• Content triggers spam filters: ALL CAPS subject, too many exclamation marks, suspicious links, image-only body. Run through mail-tester.com — aim for 9+/10.
• Domain has no sending history — IP/domain reputation builds over 2–4 weeks of consistent sending.
• Recipient's domain has an aggressive spam filter (corporate filters especially). Ask recipient to whitelist.

DMARC reports show failures from unexpected IPs

• Someone else might be spoofing your domain — DMARC at p=reject will stop them. The reports tell you who's trying.
• You forgot to add an SPF include for another legitimate service (e.g. your ticketing tool also sends from your domain). Add it.

"DKIM signature missing" in email headers

• DKIM DNS record exists but provider hasn't activated signing. Re-check the provider's DKIM page — usually a "Verify" or "Activate" button after DNS propagation.
• Wrong DKIM selector. The TXT record must be at {selector}._domainkey, where selector is provider-specific (google, scoped-001, k1, etc.).

FAQ

What's next