[ Sending-service guides ]

Verify former Pobox sending domains in Fastmail after migration

Treat Pobox as a migrated service, preserve functioning inherited domains, and verify current Fastmail sending identities without confusing forwarding with outbound authentication.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Preserve functioning inherited domains after Pobox migration.
  • Compare actual client submission with the current Fastmail account.
  • Do not remove active selectors merely because an example is deprecated.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Do not remove active selectors merely because an example is deprecated.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Trace the current submission route

Inherited DNS and a mail client can follow different service paths.

Next steps

  1. Check the Fastmail domain status before editing.
  2. Compare desktop and webmail message identities.
  3. Retain active selectors until a verified transition is complete.

CISO / SecOps

Review migration trust boundaries

Provider-owned addresses and organization-owned domains have different controls.

Next steps

  1. Verify DNS authority before authorizing records.
  2. Check receiver alignment rather than branding.
  3. Keep account exceptions and untested routes visible.

Founder / Non-technical

Preserve working mail during change

A migrated service does not automatically require replacing working DNS.

Next steps

  1. Identify the custom domains and addresses that matter.
  2. Separate invoice or application failures from forwarding issues.
  3. Approve changes only against a demonstrated mismatch.

[ FAQs ]

Frequently asked questions

Can I follow a new standalone Pobox DKIM setup today?

Current Fastmail documentation says all Pobox customers migrated in November 2024. Use the current account and migration-aware instructions, not an assumed legacy console.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Must every migrated domain change its DNS?

No. Fastmail says existing personal domains continue working without DNS changes. Inspect current status and actual messages before proposing changes.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Can I change DNS for my pobox.com address?

Not unless you control that provider-owned domain. Troubleshoot provider addresses with the service; customer DNS changes apply to domains you control.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

How many DKIM CNAMEs does the current Fastmail manual show?

Three: fm1, fm2 and fm3 under _domainkey. Use the exact targets for your domain and confirm applicability to the current account.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Should I remove a legacy selector immediately?

No. Determine whether it is still used and follow an approved transition. A deprecated example alone does not prove the record is safe to delete.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Why can webmail pass while a desktop client fails?

The desktop client may submit through a different SMTP service or use a different From identity. Compare received headers from both routes.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Does changing MX fix outbound authentication?

Not by itself. MX governs inbound routing; outbound identity depends on the actual submission and sending path.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

What is still unverified?

The customer account, inherited DNS, live sending and forwarding paths, migration exceptions, and human SME approval. This is a documentation-based draft.

Fastmail Guide for Pobox users Fastmail Manual DNS configuration Fastmail DMARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

[ Sources ]

Sources

  1. Fastmail Guide for Pobox users

    Sections Migration39–43; Mail client setup; Personal domains169–181

  2. Fastmail Manual DNS configuration

    Sections Three CNAME92–98; deprecated100–103; SPF105–109

  3. Fastmail DMARC

    Sections What is DMARC44 onward; forwarding and client transformations

  4. SPF RFC 7208

    Sections §3.2; 3.3; 4.6.4

  5. DKIM RFC 6376

    Sections §3.5; 3.6.2; 6.1

  6. DMARC RFC 9989

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Migrated domain
A custom domain carried from a former Pobox account into its current Fastmail account.
Submission route
The service through which a client or application hands an outbound message to a mail server.
DKIM CNAME delegation
A DNS alias directing a selector lookup to a provider-managed public-key location.
Forwarding
Delivery of received mail onward to another address, distinct from authoring a new outbound message.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base