Set Up Namecheap Private Email MX Records: Step-by-Step DNS Guide

Your new custom mailbox will silently bounce every incoming message until your DNS zone points to the right mail exchangers. Adding Namecheap Private Email MX records takes about five minutes, but a single stray priority record or malformed hostname can trap your incoming mail in an endless routing loop.

I ran into this exact headache while setting up a domain for a client recently. Here are the exact DNS values you need, how to plug them into Namecheap BasicDNS (or an external host), and the terminal commands I use to confirm routing works right away.

The DNS Values Required for Namecheap Private Email

Namecheap runs its own email infrastructure (built on Open-Xchange/Jellyfish). To receive email, you need two MX records. To get webmail running on your own subdomain and let clients like Apple Mail or Thunderbird auto-configure, you also need three CNAME records.

Here are the exact records you need in your DNS zone:

• Primary MX: Host @, Value mx1.privateemail.com, Priority 10, TTL Automatic (or 300)
• Secondary MX: Host @, Value mx2.privateemail.com, Priority 10, TTL Automatic (or 300)
• Webmail CNAME: Host mail, Value privateemail.com, TTL Automatic
• Autoconfig CNAME: Host autoconfig, Value privateemail.com, TTL Automatic
• Autodiscover CNAME: Host autodiscover, Value privateemail.com, TTL Automatic

Both MX records share priority 10 on purpose. Namecheap load-balances incoming connections across mx1 and mx2. If one node is busy, sending MTAs fall back to the other per RFC 5321 standards.

Step 1: Check Where Your DNS Zone Actually Lives

Before you touch the Namecheap dashboard, verify where your nameservers actually point. If you pointed them to Cloudflare, Vercel, or Hostinger, changing records in Namecheap BasicDNS won’t do a thing.

Run a quick NS query from your terminal:

dig NS yourdomain.com +short

If you see dns1.registrar-servers.com and dns2.registrar-servers.com, you are on Namecheap BasicDNS or PremiumDNS, so you can edit records directly inside Namecheap.

If the command returns third-party nameservers, add these MX records in that provider’s DNS panel instead. If you are splitting DNS between different providers, check our guide on how to point Namecheap DNS to Hostinger without breaking email.

Step 2: Add MX Records in Namecheap BasicDNS

If your nameservers point to Namecheap, you can use their automated dropdown or enter them by hand. I prefer manual entry so I can confirm priorities myself.

1. Log in to Namecheap and open your Domain List.
2. Hit Manage next to your domain.
3. Click the Advanced DNS tab.
4. Scroll down to Mail Settings.
5. Pick Custom MX from the dropdown (or choose Private Email if you want the preset).
6. Add these two records:

Your custom entry should look like this:

Type: MX Record
Host: @
Value: mx1.privateemail.com
Priority: 10
TTL: 30 min (or Automatic) Type: MX Record
Host: @
Value: mx2.privateemail.com
Priority: 10
TTL: 30 min (or Automatic)

Hit the green checkmark to save both rows. Remove any leftover default or parking MX records. Leaving an old mail.yourdomain.com record sitting at priority 0 will hijack your traffic and bounce every incoming email.

Step 3: Add Authentication Records (SPF, DKIM, and DMARC)

MX records only tell other servers where to deliver inbound mail. Without SPF, DKIM, and DMARC, messages you send will get flagged as spam or dropped by Gmail and Outlook.

In the Host Records section of Advanced DNS, add these TXT records:

Type: TXT Record
Host: @
Value: v=spf1 include:spf.privateemail.com ~all
TTL: Automatic Type: TXT Record
Host: _dmarc
Value: v=DMARC1; p=none; sp=none; pct=100;
TTL: Automatic

For DKIM, Namecheap generates a unique key per domain. Go to your Namecheap dashboard, open the Private Email management area, pick your domain, and grab your DKIM public key. You will add a CNAME or TXT record for the selector (usually s1._domainkey).

If you also send transactional emails through a separate provider like SendGrid or Postmark, read our guide on how to configure SPF, DKIM, and DMARC records in Namecheap DNS to avoid overwriting your SPF strings.

Step 4: Configure Webmail and Client Autodiscovery

To access webmail at mail.yourdomain.com and let email clients automatically detect your IMAP and SMTP settings, add these three CNAME records under Host Records:

Type: CNAME Record
Host: mail
Target: privateemail.com.
TTL: Automatic Type: CNAME Record
Host: autoconfig
Target: privateemail.com.
TTL: Automatic Type: CNAME Record
Host: autodiscover
Target: privateemail.com.
TTL: Automatic

If you route other subdomains to custom apps or VPS instances, make sure none of these overlap. See our guide on how to route subdomains to different servers in Namecheap DNS if you need to keep app traffic and mail routing separate.

How I Debugged a Silent MX Conflict

I recently set this up on a domain where everything looked clean in the dashboard, but test emails from my Google Workspace account failed with this bounce message after 12 minutes:

550 5.1.1 : Recipient address rejected: User unknown in virtual mailbox table

The web UI showed the right records, but querying the zone directly with dig told a different story:

dig MX yourdomain.com +noall +answer

The resolver returned three records instead of two:

yourdomain.com. 1799 IN MX 0 mail.yourdomain.com.
yourdomain.com. 1799 IN MX 10 mx1.privateemail.com.
yourdomain.com. 1799 IN MX 10 mx2.privateemail.com.

The hosting cPanel had silently injected an automatic mail.yourdomain.com record at priority 0. MTAs always try the lowest number first. Because priority 0 pointed to a server with no active mail server listening, incoming mail never made it to Namecheap at priority 10.

Once I deleted that priority 0 record and flushed local DNS, test messages landed in under 30 seconds.

Verify Mail Routing via CLI and Web Tools

Never trust a green checkmark in a web dashboard. Query public resolvers like Google (8.8.8.8) and Cloudflare (1.1.1.1) directly from your terminal to see what external mail servers actually see.

Run these two checks:

# Query MX records against Cloudflare DNS
dig @1.1.1.1 yourdomain.com MX +short # Query SPF TXT record against Google DNS
dig @8.8.8.8 yourdomain.com TXT +short

You should see only these two records in the answer section:

10 mx1.privateemail.com.
10 mx2.privateemail.com.

You can also run the domain through Google Admin Toolbox Dig to confirm how Google’s edge resolvers view your MX records worldwide.

Manual IMAP and SMTP Client Settings

If you are setting up Thunderbird, Outlook, or Apple Mail manually rather than relying on Autodiscover, use these connection parameters. Always enforce SSL/TLS:

• Incoming Mail Server (IMAP): mail.privateemail.com, Port 993, Security SSL/TLS
• Incoming Mail Server (POP3): mail.privateemail.com, Port 995, Security SSL/TLS
• Outgoing Mail Server (SMTP): mail.privateemail.com, Port 465 (or 587 with STARTTLS), Security SSL/TLS
• Username: Your full email address (e.g., hello@yourdomain.com)
• Authentication: Password required (your mailbox password)

If your web app sends alerts through these credentials, verify that your apex domain resolves properly first. See our guide on how to point root domains in Namecheap DNS using A records vs CNAME to prevent apex record conflicts.

Frequently Asked Questions

How long do Namecheap Private Email MX records take to propagate?

With Namecheap BasicDNS and TTL set to Automatic (30 minutes), propagation usually takes between 15 and 45 minutes. If a previous record was cached with a higher TTL (like 86400 seconds), external resolvers can take up to 24 hours to clear the cache.

Can I use Namecheap Private Email alongside Google Workspace on the same domain?

Not on the exact same root domain. Mail servers deliver to whichever MX records have the lowest priority number. If you need both, keep one on your apex domain and put the other on a subdomain like support.yourdomain.com.

Why does webmail show an SSL certificate mismatch?

If you visit https://mail.yourdomain.com and get an SSL warning, your domain lacks an SSL certificate covering that specific CNAME. You can issue a free certificate on your web host covering the mail subdomain, or simply log in directly through https://privateemail.com.

What happens if I forget to add the trailing dot in my DNS editor?

In BIND-style DNS editors (like cPanel), omitting the trailing dot on privateemail.com. appends your root domain, creating a broken record like mx1.privateemail.com.yourdomain.com. In Namecheap’s native dashboard, you do not need the trailing dot.

Next Steps

Once your MX records resolve cleanly, fire off a test email from an external Gmail or Outlook account and inspect the full message headers to verify SPF and DKIM pass without errors. If you ever migrate to another registrar, export your zone file beforehand so you do not lose your email routing setup.