The moment you tweak custom DNS records or route an apex domain to a separate server, Namecheap Private Email usually dies quietly. You won’t get an alert—mail just stops landing, 550 relay errors bounce back to senders, and desktop clients refuse to connect. Here is how to manually wire the exact MX, SRV, CNAME, and TXT records in Namecheap Advanced DNS so everything works without relying on flaky presets.
The Problem with Automated Mail Presets
Namecheap has an automated dropdown labeled Private Email under the Mail Settings tab. On a bare-bones domain pointing straight to their basic shared hosting, it works. But the second you add custom subdomains, route an app elsewhere, or toggle between BasicDNS and external hosts, that preset either vanishes or silently wipes records you actually need.
I ran into this exact mess last month while splitting an apex domain between an app on a VPS and mail on Namecheap. The preset vanished on save, incoming mail disappeared into a black hole, and Apple Mail couldn’t detect IMAP settings anymore. The automated button is too unpredictable. Manually setting each record inside the Advanced DNS tab is the only reliable way to keep your zone file intact.
Before touching anything, check where your nameservers actually point. If you use external hosting DNS—for example, if you need to keep Namecheap Private Email working on Hostinger nameservers—put these identical records into your host’s DNS editor instead. If your domain is set to “Namecheap BasicDNS” or “Namecheap PremiumDNS”, handle them directly in Namecheap’s dashboard as shown below.
The Core DNS Record Blueprint
Namecheap Private Email relies on four separate record types. Skip one, and something breaks: MX handles routing, SRV handles calendar and address book sync, CNAME handles webmail and autoconfig, and TXT keeps you out of the spam folder.
Here is what we are configuring:
- MX Records:
mx1.privateemail.comandmx2.privateemail.com(both Priority 10). - CNAME Records:
mailpointing toprivateemail.com, plusautoconfigandautodiscoveraliases for mail client setups. - SRV Records:
_caldavs._tcpand_carddavs._tcppointing toprivateemail.comon port 443 for zero-config CalDAV/CardDAV sync. - TXT Records: SPF validation and DKIM keys to pass DMARC checks.
Step 1: Purge Conflicting Mail Settings
First, stop Namecheap’s automated helper from overwriting your work. In your Namecheap dashboard, click Manage next to your domain and find the Mail Settings section on the main Domain tab.
Change the Mail Settings dropdown to Custom MX. If you leave it on Namecheap Private Email, Gmail, or No Email Service, the dashboard can inject ghost records or hide manual MX inputs in the Advanced DNS editor. Switching to Custom MX hands raw control back to your zone file.
Now head to the Advanced DNS tab at the top. Check the Host Records table. If you have old MX records pointing to eforward.namecheap.com (leftovers from when you had to free email forwarding in Namecheap DNS) or old parking servers, delete them. Dual MX records with conflicting targets split your inbound traffic, meaning half your inbound emails hit dead endpoints.
Step 2: Add Manual MX Records
In the Advanced DNS tab, scroll down past the main Host Records table to the Mail Settings section. Since you selected Custom MX, you can add raw records here.
Click Add New Record and drop in Namecheap’s active mail endpoints:
Type: MX Record
Host: @
Value: mx1.privateemail.com
Priority: 10
TTL: Automatic (or 30 min) Type: MX Record
Host: @
Value: mx2.privateemail.com
Priority: 10
TTL: Automatic (or 30 min)Namecheap used to route everything through a single mail.privateemail.com target, but their current setup balances traffic across mx1 and mx2. Keep both at Priority 10. That way, if Cluster 1 has an outage or maintenance window, Cluster 2 catches connections instantly.
If you’re configuring mail for a specific subdomain (like notify.yourdomain.com), change the Host value from @ to that prefix. For your primary root domain, leave it as @.
Step 3: Configure Autodiscover and Webmail CNAMEs
Nobody wants to manually enter IMAP ports, SMTP servers, and SSL settings on every phone and laptop. Adding standard autodiscovery CNAMEs lets clients pull those connection parameters automatically via RFC 6186 client autodiscovery.
In the Host Records table (the upper table, not the Mail Settings block), click Add New Record and add these three CNAMEs:
Type: CNAME Record
Host: mail
Value: privateemail.com.
TTL: Automatic Type: CNAME Record
Host: autoconfig
Value: privateemail.com.
TTL: Automatic Type: CNAME Record
Host: autodiscover
Value: privateemail.com.
TTL: AutomaticNamecheap automatically strips trailing dots from host values when saving, so don’t worry if privateemail.com. loses its dot after you commit it. The mail record gives you a direct link (like mail.yourdomain.com) straight into webmail.
The autoconfig host handles Thunderbird and K-9 Mail, while autodiscover is what Outlook and iOS look for. Without them, you’re forced to type in mail.privateemail.com, IMAP port 993 (SSL), and SMTP port 465 (SSL) every single time.
Step 4: Configure SRV Records for CalDAV and CardDAV
This is the part most tutorials skip entirely. If you want Namecheap Private Email to sync your calendars and contacts across devices, clients need to locate your CardDAV and CalDAV endpoints via RFC 2782 DNS SRV records.
In the Host Records table, select SRV Record from the type dropdown. Namecheap splits SRV parameters into individual fields: Service, Protocol, Priority, Weight, Port, and Target. Add these two rows:
# CardDAV Record (Contacts)
Service: _carddavs
Protocol: _tcp
Priority: 0
Weight: 0
Port: 443
Target: privateemail.com
TTL: Automatic # CalDAV Record (Calendars)
Service: _caldavs
Protocol: _tcp
Priority: 0
Weight: 0
Port: 443
Target: privateemail.com
TTL: AutomaticIn Namecheap’s UI, do not put a period before the target—just type privateemail.com. Port 443 is required because all modern CalDAV and CardDAV traffic runs over HTTPS.
Once these propagate, macOS Calendar and iOS Contacts sync automatically as soon as you add your account under “Internet Accounts”. No digging through webmail settings for raw DAV URLs.
Step 5: Lock Down Deliverability with SPF, DKIM, and DMARC
MX records only handle inbound delivery. If you don’t authenticate outbound mail, Gmail, Yahoo, and Outlook will send your replies straight to junk or drop them entirely.
We have a full breakdown on how to configure SPF, DKIM, and DMARC in Namecheap DNS, but you should add the baseline records right now while you are in the dashboard.
SPF Record
In the Host Records table, add a new TXT Record:
Type: TXT Record
Host: @
Value: v=spf1 include:spf.privateemail.com ~all
TTL: AutomaticIf you already have an SPF record for services like Postmark or SendGrid, never add a second TXT record with v=spf1. Having multiple SPF records breaks lookup validation immediately. Just merge them by adding include:spf.privateemail.com into your existing record right before the ~all flag.
DKIM Record
Namecheap creates a unique DKIM key for every domain. Head into your Private Email dashboard, go to DNS Settings or Domain Settings, and grab your DKIM public key string.
It maps into Namecheap Advanced DNS as a TXT record:
Type: TXT Record
Host: default._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...YourLongKeyHere...
TTL: AutomaticThe selector host is usually default._domainkey or s1._domainkey. Paste whatever prefix Namecheap provides into the Host field, then paste the full string (including p=...) into Value.
Verify Your Records from the Terminal
Don’t trust the dashboard green checkmarks. DNS panels often cache local input states rather than checking public resolvers. Use dig to see what the world actually sees.
Check your MX records against Google’s public resolver:
dig mx yourdomain.com @8.8.8.8 +shortYou should see both clusters returned:
10 mx1.privateemail.com.
10 mx2.privateemail.com.Next, confirm your SRV records resolve properly by querying the full service path:
dig srv _autodiscover._tcp.yourdomain.com @8.8.8.8 +short
dig srv _caldavs._tcp.yourdomain.com @8.8.8.8 +shortA good response looks like this:
0 0 443 privateemail.com.Finally, inspect your SPF record to make sure there are no accidental duplicates:
dig txt yourdomain.com @8.8.8.8 +short | grep "v=spf1"If two distinct v=spf1 lines show up, delete one immediately. Under the RFC 7208 SPF specification, multiple SPF records cause an automatic PermError, failing DMARC.
Gotchas That Break Manual Configuration
A few traps that regularly bite people on Namecheap:
- The Root CNAME Conflict: If you have a CNAME on the apex (
@) pointing to an external provider like Vercel or GitHub Pages, your MX records won’t resolve. DNS specs forbid CNAMEs from coexisting with other records on the same host. If your apex needs an alias, follow our guide to point an apex domain to a CNAME in Namecheap DNS with ALIAS records. ALIAS records resolve to A records, leaving your MX records untouched. - Trailing Spaces in the DKIM Key: When copying the base64 RSA key from the webmail dashboard, hidden newlines or trailing spaces often slip into Namecheap’s input box. That invalidates the cryptographic signature. Clean it in a plain text editor before saving.
- Local Resolver Caching: Namecheap’s authoritative servers update fast, but your local machine or ISP might cache the old NXDOMAIN response for hours. Flush your local cache before assuming the records didn’t stick:
# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # Linux (systemd-resolved)
sudo resolvectl flush-cachesNamecheap Private Email DNS FAQ
Can I use Namecheap Private Email if my site is hosted on Hostinger or AWS?
Yes. Web hosting and email routing are completely independent. If your nameservers point to Namecheap BasicDNS, follow this guide and just point your @ and www A records to your host’s IP. If your nameservers point directly to Hostinger or AWS Route 53, paste the exact MX, SRV, and CNAME values from this guide into that provider’s DNS panel instead.
Why is my mail client complaining about untrusted SSL certificates?
This happens if you put mail.yourdomain.com as the incoming/outgoing mail server in your email app instead of mail.privateemail.com, without having a dedicated SSL cert installed on your mail subdomain. Use mail.privateemail.com in your client’s host fields and the warning will go away.
What is the difference between Priority 10 on both MX records versus Priority 10 and Priority 20?
Setting both to Priority 10 load-balances incoming connections across both clusters. Setting mx1 to 10 and mx2 to 20 makes mx2 an idle fallback that only takes traffic if mx1 goes completely down. Namecheap explicitly recommends equal priority (10 and 10) for steady redundancy.
Do I still need SRV records if I only use the webmail interface?
No. If you only ever log into privateemail.com via a web browser, SRV records do nothing. But it takes thirty seconds to add them now, and it saves you from debugging failed calendar syncs later when you connect an iPhone or laptop.
Next Steps
With manual MX and SRV records locked into place, your mail setup is independent of Namecheap’s automated toggles. If you’re setting up a brand-new inbox, run through our walk-through on how to set up Namecheap Private Email MX records to verify your account provisioning parameters and check your mailbox mailbox quotas.
