What is an apex domain? DNS zone apex explained (SPF, DKIM, DMARC)

dmarcdkimspffaq

“Apex domain” is one of those phrases that sounds more exotic than it is.

In day-to-day DNS work, the apex is simply the top name of the zone being edited. If the DNS zone is example.com, then the apex is example.com itself (sometimes shown as @ in DNS dashboards). If the zone is news.example.com because that subdomain was delegated to a different DNS provider, then the apex is news.example.com.

That last bit is the part people often miss: “apex” is not a magic global concept. It is “the top of this zone”.

Apex domain vs “root domain” vs “registered domain”

These terms get mixed together in email projects, and it causes unnecessary confusion.

  • Zone apex: the top of whatever DNS zone is being managed right now. In most business setups, this is the same as the main domain.
  • Registered domain: the domain paid for at the registrar (often the organizational domain people put after the @ in email addresses).
  • Public suffix: the part you can’t normally register (like com, co.uk). This matters because DMARC uses the public suffix list to figure out the “organizational domain”.

So, example.com is typically all three: the registered domain, the zone apex (if the zone is hosted for example.com), and the organizational domain used by DMARC.

But example.co.uk is where the nuance shows up. co.uk is the public suffix; the organizational/registered domain is example.co.uk; the zone apex might be example.co.ukor a delegated sub-zone like mail.example.co.uk, depending on how DNS is arranged.

If a DNS UI shows a name column with @, it almost always means “this record is at the zone apex”. It’s shorthand, not a special DNS record type.

Where SPF, DKIM, and DMARC records live (and why they still “belong” to the apex)

This is the practical reason “apex domain” comes up in email authentication work: most of the policies people care about are anchored under that main domain.

Start with the three basics, if needed: What is SPF?, What is DKIM?, and What is DMARC?.

Now the DNS side.

SPF

SPF is published as a TXT record on the domain that appears as the SPF identity.

For many organizations, that’s the apex domain:

example.com.  TXT  "v=spf1 include:_spf.example.net -all"

But SPF can also be evaluated on a subdomain (for example, when the Return-Path / bounce domain is something like bounce.example.com). That’s where “apex vs subdomain” stops being academic and starts being a debugging tool. If SPF passes but DMARC fails, the bounce domain often isn’t aligned with the visible From domain. The alignment angle is covered in more detail here: DMARC alignment: From vs Return-Path (strict vs relaxed).

DKIM

DKIM is the one that looks like it’s not at the apex, because the TXT record name includes extra labels:

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=..."

Even though that record is not literally on example.com, it is still “under the apex domain”. The selector (s1) and _domainkey are just a structured namespace.

The practical takeaway: when someone says “DKIM for the apex domain”, they usually mean the DKIM signing domain (d=) is example.com, not news.example.com or mailer.example.com.

DMARC

DMARC does the same “structured name under the domain” thing:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

That record is the DMARC policy for mail that claims to be from @example.com.

Here’s the subtle-but-important part: if a message is from user@news.example.com, the receiver will look for _dmarc.news.example.com. If that doesn’t exist, it will fall back to the organizational domain policy (typically _dmarc.example.com). This is why a single DMARC record at the apex can cover a lot of subdomain mail by default.

When subdomains have different risk profiles (marketing platforms, ticketing systems, password reset mail), a dedicated policy strategy is usually cleaner than hoping everything behaves “like the apex”. The details are here: DMARC subdomain policy best practices: sp, dedicated records, and inheritance gotchas.

The apex-specific DNS gotchas that break email auth

Email authentication doesn’t require anything mystical at the apex, but the apex is where DNS constraints are sharpest.

The CNAME-at-apex problem

DNS standards don’t allow a CNAME record at a name that also has other record types.

At the apex, that matters because the apex typically needs things like:

  • MX (where inbound mail is delivered)
  • TXT (SPF, sometimes verification tokens)
  • A/AAAA (website)

So if a DNS provider or a “point the root domain at this host” tutorial pushes toward putting a CNAME at example.com, it can conflict with mail-related records.

Some providers offer workarounds with vendor-specific record types (ALIAS, ANAME) that behave like a CNAME for HTTP hosting but still allow MX and TXT. Those can be perfectly fine. The key is to notice when a tool or UI is trying to replace the apex with a CNAME and accidentally drops mail records.

Duplicate TXT records and “split SPF”

Another classic apex foot-gun: multiple TXT records that look like SPF.

SPF requires a single SPF record per domain. Two different records like these:

example.com.  TXT  "v=spf1 include:_spf.google.com ~all"
example.com.  TXT  "v=spf1 include:spf.mailer.example ~all"

…will often produce SPF PermError. Not “somewhat degraded”, but “fail in confusing ways”.

It’s totally normal to have multiple TXT records at the apex in general (verification strings, random service tokens). The rule is specific to SPF: only one v=spf1.

DKIM/DMARC are not “apex TXT records”

This is a smaller confusion, but it comes up a lot when staring at a DNS UI.

  • DKIM records live at <selector>._domainkey.<domain>.
  • DMARC records live at _dmarc.<domain>.

So if a checklist says “add DMARC to the apex domain” it means “add DMARC for the organizational domain”, not “add a TXT record whose host/name is @.”

For a quick reference on DMARC tag choices (including safe defaults), this is handy: DMARC record tag cookbook (p, sp, pct, rua, ruf, fo, ri, rf).

A quick mental model that prevents 80% of DNS mistakes

When working on email auth DNS, keep these three questions in mind:

  1. Which zone is being edited right now (what does @ mean in this UI)?
  2. Which domain is the message claiming in the visible From header (that’s DMARC’s starting point)?
  3. Which domain is used for SPF and DKIM identities (and are they aligned with the From domain)?

If those three are clear, “apex domain” stops being a fuzzy word and turns into something concrete: the place policies usually attach, and the part of DNS where record-type constraints are easiest to trip over.

Previous PostNext Post