Domain Setup
Verify DNS on an ICTA-approved government domain for mailboxes, sending, and inbound mail.
Taifa Mail is ICTA-first: a domain must be approved by ICTA through an allocation request before it can appear here and be verified. There is no self-service "add any domain" form. Once a domain is approved (or is a subdomain of one that is), this page is where you publish the DNS records and verify it before creating mailboxes or sending.
Don't have an approved domain yet? See Request domains & mailboxes from ICTA to submit your proposed domains, reasons, mailbox counts, and Authorizing Officer's letter.
Add your domain
Once ICTA approves a domain, or once you have an existing approved domain, you can add it here:
- A domain ICTA just approved appears automatically once the decision lands - there is nothing to click.
- A subdomain of an already-approved domain (for example
mail.health.go.keunder an approvedhealth.go.ke) can be added directly, without a new allocation request, because it inherits the parent's approval:- Go to Domains in the sidebar.
- Click Add Domain.
- Enter the subdomain name.
- Click Add.
Adding any other domain (one that is not itself approved and is not a subdomain of an approved domain) is rejected - submit an allocation request for it instead.
Taifa Mail generates the required DKIM keys and DNS records automatically. You will see five records to add to your DNS provider.
Add DNS records
When you add a domain, Taifa Mail generates five DNS records:
| Record | Type | Purpose |
|---|---|---|
| Domain ownership | TXT | Proves the institution controls the domain (taifa-verify=...) |
| SPF | TXT | Authorises Taifa Mail to send for the domain |
| DKIM | TXT | Adds a cryptographic signature to your emails |
| DMARC | TXT | Tells receivers how to handle authentication failures |
| Return path | CNAME | Routes bounce notifications back to Taifa Mail |
Copy each record exactly as shown on the Taifa Mail domain page. See DNS Records Explained for details on what each record does.
These five records are all you need to send. To also receive mail for official mailboxes, the Inbox, or email forwarding, add an MX record as well. See DNS Records Explained.
Automatic setup with Domain Connect
If your domain is hosted at a registrar that supports Domain Connect, Taifa Mail can publish the records for you. On the domain page, use the Set up automatically option. You are redirected to your registrar, which shows a summary of the records to add and an Authorize button. After you authorize, return to Taifa Mail and verify the domain.
If automatic setup is not available for your registrar, add the records manually as described above.
Verify your domain
Once you have added all the records at your DNS provider:
- Return to the Domains page in Taifa Mail.
- Click Verify next to your domain.
Your domain status will move from pending to verified once all records are confirmed.
Use the DNS Checker tool before clicking Verify. It lets you confirm your records are visible before triggering the official verification check.
DNS propagation can take up to 48 hours depending on your provider and TTL settings. If verification fails, wait a few hours and try again.