Anjal
Get started
Knowledge baseOperations

MX records without breaking your primary domain

Operations

Your main company domain probably already has mail. Here's how to add Anjal without blowing up your existing inbox.

The problem

A domain can only have one set of MX records. If you point yourcompany.com's MX at Anjal, all mail for yourcompany.com — including your existing you@yourcompany.com inbox — starts flowing into Anjal, and your Google Workspace/Outlook/Fastmail inbox goes dark.

The fix: use a subdomain

Register the domain as mail.yourcompany.com (or agents.yourcompany.com, or any subdomain that isn't already in use) instead of the apex:

curl -X POST https://anjal.app/v1/domains \
  -H "X-API-Key: tk_..." -H "Content-Type: application/json" \
  -d '{"domain": "mail.yourcompany.com"}'

MX records for a subdomain are completely independent of the apex. Your you@yourcompany.com inbox keeps working at its existing provider; mail to agent@mail.yourcompany.com routes to Anjal.

What to set

In your DNS editor, under the mail subdomain, add exactly what the domain verify response gives you:

  • MX: mail.yourcompany.com. IN MX 10 mail.anjal.app.
  • TXT DKIM: the long RSA record on the selector hostname we return
  • CNAME bounce handler: on bounce.mail.yourcompany.com.

Why not just use the apex?

You can, if the apex has no existing MX or you're migrating away from another provider. But for most existing businesses the apex is load-bearing and a subdomain is a zero-risk move. SPF and DKIM alignment still work correctly for subdomain sends; DMARC aspf=r / adkim=r (relaxed alignment, the default) treats subdomains as aligned with the organizational domain.

Keep Google Workspace or Microsoft 365 on the main domain

If you want agent addresses on the apex itself (agent@yourcompany.com) while your team stays on Google Workspace or Microsoft 365, register the domain as shared. Anjal notices when a domain already has MX records elsewhere: without either option below, POST /v1/domains returns 422 DOMAIN_HAS_MAIL_PROVIDER with the detectedProvider, the mx hosts and a fix string, instead of cutting off your mail.

curl -X POST https://anjal.app/v1/domains \
  -H "X-API-Key: tk_..." -H "Content-Type: application/json" \
  -d '{"domain": "yourcompany.com", "sharedWith": "google"}'

sharedWith is "google", "microsoft" or "other". With it:

  • No MX record is returned. Your provider stays the main mail server.
  • The SPF TXT record is merged into your existing SPF. Its note tells you to replace the existing record, because a domain may have only one SPF record.
  • Anjal's DMARC record is only included if the domain has none.
  • The response includes routingSteps for your provider's admin console. Google: add a host route to the Anjal mail host and a Default routing rule that sends mail for non-recognized addresses there. Microsoft: set the Accepted domain to Internal relay and add an outbound connector to the Anjal smart host.

The trade-off. Your provider only passes on mail for addresses it doesn't know, so it keeps its own users and an Anjal mailbox can't share a name with one of them. It also means one more hop and one more console to configure. If you don't need the apex, a subdomain such as agents.yourcompany.com is simpler.

To move all of the domain's mail to Anjal instead, send "replaceMailProvider": true; the MX record returned replaces your provider's.