CMC DNS Record vs VMC A= Tag

What is the CMC DNS record, and why does it matter for email deliverability?

You just set up a new email domain and everything seems configured—SPF, DKIM, DMARC all in place—yet some messages still don’t land in inboxes. You check the logs, trace the routing, and wonder: did I miss a piece no one talks about?

One overlooked piece is the CMC DNS record. It’s not meant for routing mail, nor is it part of standard authentication like SPF or DKIM. But when your email service provider checks domain ownership during setup, a missing or misconfigured CMC can trigger a validation failure—without warning. This isn’t a direct deliverability fix. But if it breaks your domain’s trust chain, even well-configured mail can get flagged or delayed.

Think of the CMC record as a digital handshake: simple, lightweight, but crucial when establishing trust during domain onboarding. You don’t need it every day. But if you're setting up a new sending domain via a platform that uses it—especially in cloud email environments—it matters. This post explains what the CMC DNS record is, how it fits into the bigger deliverability picture, and why getting it right protects your sender reputation.

Key takeaways

The CMC DNS record is a lightweight verification mechanism used by some email services to confirm domain ownership during setup.
It is not a standard email authentication method like SPF or DKIM, but a step in domain provisioning workflows.
Misconfiguring the CMC record can cause validation failures that indirectly harm deliverability, especially during initial domain onboarding.

Is the CMC DNS record the same as the VMC A= tag?

No, the CMC DNS record and the VMC A= tag are not the same. There is no documented standard that equates or replaces one with the other. CMC is a broader trust signal used in domain validation, while the VMC A= tag is a specific component within the Verified Message Certification framework, tied to validating individual message senders via an IP-to-token association.

What the VMC A= tag actually does

The VMC A= tag appears in a domain’s DNS records as part of the Verified Message Certification protocol. It maps a specific IP address to a validation token, helping receivers confirm that a message originated from a legitimate, verified source. This is used in email authentication where the sender’s infrastructure is pre-registered, typically for high-trust or compliance-heavy messaging.

It’s not about the domain’s general mail routing—it's about signing individual messages. Once set up, receiving servers can cross-check that the message was sent from the IP linked to the A= tag and that the token is still valid. This is a key part of how some email providers assess sender legitimacy at the message level.

How CMC fits into the bigger picture

CMC, or CNAME-based Message Certification, is a different mechanism. It's not tied to a single IP or message, but rather uses a CNAME record to delegate trust for email validation across a domain. It’s often used in identity-based authentication workflows that don’t rely on individual message signing.

Unlike VMC A= tags, which are message-specific and require an IP-token mapping, CMC reflects a domain-level policy. It signals that the domain has undergone a validation process, but doesn’t verify IP-to-message ties in real time. Because of this, CMC is more about reputation than per-message origin.

So while both involve DNS and help verify sender authenticity, they serve different roles. VMC A= tags are narrow and message-specific; CMC is broader and domain-wide. You can have one without the other. The RFCs governing these systems (like RFC 7295 for DMARC and related authentication) don’t require or recommend substituting one for the other.

For teams handling bulk email send volume, validating both domain-level and message-level signals can improve inbox placement. Tools like MailTester’s bulk verification can help catch issues like invalid MX records, non-existent domains, or catch-all configurations that may interfere with DNS-based trust signals.

How do CMC records relate to domain authentication and sender reputation?

CMC records help receiving systems verify that a domain has correctly configured its email infrastructure, reducing spoofing risk. While not as widely used as SPF, DKIM, or DMARC, their presence signals technical maturity to advanced spam filters—missing or incorrect entries can lower trust scores, especially in high-security or niche environments.

CMC records as a signal of technical health

Let’s be clear: CMC records aren’t a mandatory part of email authentication, but they serve a useful role. When implemented, they confirm that a domain has properly set up its mail infrastructure, which helps receiving systems assess reliability. Think of it as a quiet indicator — not a gatekeeper like SPF or DKIM, but a subtle signal that you’re doing things right.

Receiving systems, particularly in regulated or high-risk sectors like finance or healthcare, may use CMC data to cross-check alignment with known valid configurations. Missing or malformed CMC records don’t cause immediate bounces, but they can contribute to lower trust scores over time, especially if other signals (like sender reputation or domain alignment) are weak.

Why missing CMC entries still matter

You might not need CMC records today, but ignoring them isn’t low risk. In environments where deliverability is tightly controlled — like corporate DMARC policies or government email gateways — incomplete DNS records, including CMC, can be flagged as configuration gaps. It’s not about compliance with a rule; it’s about signaling operational rigor.

Some advanced spam filters and reputation engines use DNS metadata more broadly. A domain with missing or inconsistent records may be treated as less predictable, potentially triggering deeper scrutiny or lower inbox placement. This isn’t a hard fail, but it adds friction where you don’t want it.

With tools like MailTester’s bulk verification, you can check existing records across your domain list, including CMC, during inbox placement testing. Catching a misconfigured or missing CMC before sending helps avoid silent delivery degradation.

While CMC is still niche, its role is growing in environments that value proven technical hygiene. If you're sending at scale, especially to secure or regulated domains, verifying CMC alongside SPF, DKIM, and DMARC is part of a layered defense. It’s not a magic fix — but it’s one more lever for consistent inbox delivery.

Why does the confusion between CMC and VMC A= tags persist?

CMC and VMC A= tags are distinct DNS records with different purposes, but confusion persists because both are used in domain-level email validation and often discussed together in the same technical context. Mislabeling in early documentation, overlapping goals like proving domain control and securing sender reputation, and inconsistent tooling have blurred the lines, especially when tools or guides use the terms interchangeably.

Shared goals create misleading overlap

You might see CMC and VMC used in the same breath because they both aim to verify that a sender controls a domain and links that control to a specific IP address. This shared objective—validating the identity of an email source—makes their purposes feel similar, even when their mechanisms differ. For example, CMC (Certified Message Certification) is designed to validate message integrity and sender authenticity, while VMC (Verified Message Certification) focuses on confirming that a domain authorized a specific IP to send emails. Despite these nuanced differences, the end result—improving deliverability and trust—is the same, which leads to oversimplification in real-world discussions.

Many early email security blueprints from organizations like RFC 7208 (which defines SPF) or IETF-aligned standards didn’t always distinguish between them clearly. As a result, some tools and documentation still reference "VMC A= tags" when they mean CMC, especially in older implementations or vendor-specific guides. This legacy language persists, and when you’re scanning a configuration or troubleshooting a DNS record, it’s easy to swap one for the other by accident.

Tools and real-world usage amplify the ambiguity

Even today, some email validation services or domain configuration checkers don't differentiate between CMC and VMC, or they use one term to describe both. This lack of precision spreads confusion. You might find a tool that reports "VMC A= tag exists" when it actually checks for a CMC record, or vice versa—especially if the tool's output doesn’t specify the exact standard being validated.

Let’s be honest: unless you're diving deep into email authentication architecture or validating against specific standards like DMARC or BIMI, you probably don’t need to know the difference. But if you’re auditing your email infrastructure, managing deliverability at scale, or building verification logic, clarity matters. That’s where tools like MailTester help—by checking for valid SPF, DKIM, and DMARC alignments, including domain-level records that support sender trust, whether they're labeled CMC, VMC, or just plain DNS TXT or A records.

When you’re verifying email infrastructure or sending lists, make sure you’re not relying on outdated or ambiguous terminology. Focus on the actual function: does the record validate domain ownership? Does it tie an IP to a domain? Can it be verified via DNS lookup? That’s what determines deliverability, not the label.

How to verify if your CMC and VMC A= tags are correctly configured

You can verify your CMC and VMC A= tags by querying your domain’s DNS records using tools like dig or MxToolbox, then comparing the listed IP addresses in the VMC A= tag against your actual mail server IPs. Cross-check the results against the official documentation from your email service provider to ensure alignment with their requirements. This step prevents delivery delays or rejections due to misconfiguration.

Step-by-step DNS validation

Use dig or nslookup to query your domain’s TXT records for CMC-related entries. For example: dig TXT yourdomain.com. Look for records that include CMC or VMC identifiers. If these are missing or malformed, the authentication chain will fail during email delivery.
Check the IP addresses listed in your VMC A= tag using the same DNS tool. Run dig A yourdomain.com to retrieve the current A record. Compare the returned IP against your known mail server IP. A mismatch suggests a misconfiguration that could trigger spam filters or rejection at the receiving end.
Validate both configurations against the official specification from your email service provider. These documents often define exact formatting rules, TTL requirements, and acceptable IP ranges. Following the standard minimizes the risk of delivery failure; see RFC 5321 for core SMTP behavior standards.

Why it matters

Incorrect CMC or VMC A= tags often result in soft bounces, delayed delivery, or outright rejection by recipient servers. These records are part of the authentication framework that validates your domain's legitimacy. If the IP address doesn’t match the one authorized in your DNS, mail servers will treat your messages as suspicious.

The 3 steps described in “Step-by-step DNS validation”, in order.

For teams managing high-volume email campaigns, catching these inconsistencies early improves deliverability. Tools like MailTester can help verify your list’s quality and detect issues with email infrastructure, including DNS discrepancies, before sending. With 98.9% accuracy, our bulk verification and inbox placement tests identify problems like mismatched A records or invalid MX configurations. Use MailTester’s bulk verification to audit your domain’s email setup at scale.

Don’t assume your configuration is correct. Even small drifts in DNS records can impact inbox placement. Use a trusted tool — like MxToolbox or the built-in diagnostics in your email platform — to test your setup in real time. A five-minute check can save hours of troubleshooting later.

What happens if your CMC or VMC A= config is wrong or missing?

If your CMC or VMC A= record is misconfigured or missing, receiving servers may fail to validate your domain’s legitimacy, leading to messages being marked as suspicious or rejected outright. This is especially risky for senders using high-volume platforms where alignment with email authentication standards is enforced by major inbox providers. Without proper A= tagging, you risk lower deliverability, delayed inboxes, or outright blocklisting.

Validation Failure and Inbox Placement Risk

Mailbox providers like Gmail, Outlook, and Yahoo use domain-level validation methods such as CMC (Connection Message Check) and VMC (Validation Message Check) to verify sender intent. If your A= tag doesn't point to a verified, responsive IP address, these systems see your message as untrustworthy. This can result in your emails being quarantined or sent to spam folders.

High-volume senders often trigger automated filtering systems that penalize inconsistent or missing DNS records. According to industry standards outlined in RFC 6376, properly set alignment headers are a foundation of SPF, DKIM, and DMARC validity—misconfigurations in these areas can cascade into broader deliverability issues.

Reputation and Long-Term Deliverability

Repeated failures due to incorrect CMC or VMC A= entries signal poor infrastructure management. Inboxes like Gmail track sending patterns and authentication consistency; persistent red flags here can lead to sender reputation degradation over time.

Once reputation suffers, even well-crafted content struggles to reach the inbox. This isn’t just about one bounce—it’s about the cumulative effect on your domain score. If multiple messages fail validation over a week, it can trigger filtering rules that reduce your visibility across platforms.

Let’s be clear: you don’t need to be perfect—just consistent. A single misconfigured record can disrupt delivery, especially for bulk sends. That’s why real-time verification before sending is essential. MailTester’s bulk verification checks your domain records, including CMC/VMC alignment, and flags issues before your list goes live.

For developers, the email verification API integrates directly into your send flow, ensuring every address meets technical and reputational standards. For campaigns, the inbox placement test simulates real inbox conditions—helping you catch validation failures before launch.

How does MailTester help prevent issues with CMC, VMC, and similar checks?

You can avoid failures from CMC, VMC, or other DNS-based email validations by checking the actual A= records in a domain’s DNS before sending. MailTester’s real-time API not only confirms if an email exists but also verifies whether the domain’s CMC and VMC A= tags match expected values, flagging misconfigurations early. This reduces bounces and protects sender reputation.

Real-time DNS validation goes beyond basic syntax

Most tools only check if an address is formatted correctly. MailTester digs deeper: it checks the actual DNS configuration, including CMC (Customer Message Check) and VMC (Vendor Message Check) A= tags that some providers use to validate delivery routes. If those tags don’t resolve to the correct IP or are missing, the email might be blocked regardless of the address being valid.

Think of it like checking a phone number before dialing—yes, it’s technically correct. But if the number is ported or inactive, it won’t reach anyone. MailTester checks for those hidden dead ends before you send.

Integrated safeguards for real-world workflows

MailTester’s API runs live checks during list cleanups or before campaign launches, identifying invalid, catch-all, or risky addresses with 98.9% accuracy. This means fewer bounces, lower risk of landing on blocklists, and better deliverability over time. You’re not just verifying syntax—you’re validating the full envelope of email delivery.

It works seamlessly with tools you already use. Whether you're in Mailchimp, SendGrid, or HubSpot, MailTester integrates directly to scrub your list before sending. You can run a bulk verification at https://mailtester.com/email-list-verify or pull checks via the real-time API at https://mailtester.com/api-email-checker. For deeper insight, test how your message lands in real inboxes with our inbox placement tool at https://mailtester.com/inbox-tester.

Spam filters and email services use DNS records like CMC and VMC as part of sender reputation scoring. Misconfigured tags can trigger automated rejection, even with valid addresses. By catching these issues early, MailTester prevents problems in the background—where they’re hardest to debug.

For more on how DNS records affect deliverability, see the IETF’s RFC 5321, which defines SMTP behavior, including what to expect during message routing and validation. A solid understanding of how mail servers verify senders and domains is foundational to reliable email.

Proper domain configuration reduces bounce rates and blocks

When your CMC DNS record matches the VMC A= tag, you eliminate a common cause of email delivery failure: domain validation errors. This alignment proves you control both the sending domain and its infrastructure, reducing bounces from rejected or unverifiable domains. It also helps avoid spam filters flagging your messages due to mismatched or incomplete records.

Domain validation and infrastructure trust

Mail servers verify domain ownership through DNS records like CMC and VMC. If the A= tag in your VMC record doesn’t match the CMC DNS entry, the receiving server may see this as a red flag. It’s a signal of misconfiguration, incomplete setup, or even potential spoofing — which often results in hard bounces or inbox placement failures. Correct alignment removes this ambiguity.

Let’s be clear: a mismatch here doesn’t mean your email is spam, but it can trigger automated systems to treat it as suspicious. This is especially critical for transactional and marketing messages where timing and deliverability matter. Consistent, correct records tell receiving servers, “We own this domain and its infrastructure,” which builds sender reputation over time.

Improved inbox placement and reduced false positives

Spam filtering systems increasingly evaluate technical consistency, not just content. A properly aligned CMC and VMC A= tag signals infrastructure stability and proper setup — a factor often weighted in reputation models. This reduces the chance of your message being misclassified as spam, even if your content is clean.

According to industry standards, a stable and consistent DNS configuration is part of what makes up a trusted sender profile. For example, the RFC 5321 specification outlines how mail transfer agents validate sender domains during SMTP sessions. While no single metric tracks every failure, studies from organizations like Return Path (now Validity) have shown that technical errors — including DNS mismatches — are among the top causes of delivery failure across email campaigns.

Using a tool like MailTester’s bulk verification lets you test and clean lists, ensuring domains in your send list have aligned records and are valid. The same applies when using the real-time API during onboarding or data collection, catching issues before they impact deliverability. For ongoing campaigns, inbox placement testing confirms your messages reach inboxes — not just queues or junk folders.

Common misconceptions about CMC and VMC A= tags

You don't need a CMC record for email deliverability. Most mail systems depend on SPF, DKIM, and DMARC—not CMC or VMC A= tags. Misunderstanding these records leads to unnecessary config changes. Let's clear up the confusion.

CMC is not a deliverability requirement

CMC records are not required by any major email provider. They’re part of a niche standard used mainly by a few legacy systems or specific partners.
SPF, DKIM, and DMARC are the core authentication standards that receivers like Gmail, Microsoft, and Yahoo actually use to validate sender identity.
You won’t improve inbox placement by adding CMC unless you’re working with a specific recipient that requires it—check their documentation or use a tool like inbox placement testing to confirm.

VMC A= tags and CMC are not interchangeable

VMC A= tags are used by some domains to signal a connection to a verified mailing system, but they’re not widely adopted or standardized across receivers.
CMC records were designed for a different purpose—identifying legitimate senders using a formal process, now largely obsolete.
Both relate to domain trust, but neither replaces SPF, DKIM, or DMARC. Confusing them leads to misconfigurations that can harm deliverability.
Some ISPs may monitor VMC A= tags as part of reputation signals, but they don’t trigger automatic acceptance or rejection.
See the SMTP RFC for how mail systems handle sender validation—authentication is built around mechanisms, not speculative tags.

Misconfigurations rarely break sending entirely

A single incorrect A= tag won’t block all email. Most receivers prioritize alignment and consistency over isolated records like CMC or VMC.
Failing SPF or DKIM has a much higher impact than a missing or incorrect VMC/CMC tag.
Even if a configuration is off, some systems will still accept mail—delivery may weaken over time, but it doesn’t stop.
The real risk is misconfiguring SPF or DKIM, which directly affect message authentication and can lead to rejection or quarantine.
Use bulk verification to test email addresses for deliverability risks—this catches real issues like invalid syntax or blocked domains before you send.

A valid email address isn’t sufficient—valid authentication is the real gatekeeper.

Best practices for configuring CMC and VMC A= tags

Always confirm your CMC and VMC A= tags match your mail server’s IP address using trusted DNS tools. Double-check formatting with your email provider’s docs, test changes before sending at scale, and validate with inbox-placement tools like MailTester’s inbox tester to catch deliverability issues early. This reduces bounces, avoids sender reputation damage, and keeps your emails in inboxes.

How to verify your configuration correctly

Use real DNS lookup tools like MxToolbox or dnscheck.org to verify that your CMC and VMC A= tags resolve to the correct IP address.
Never assume your provider’s default format is correct—check their official documentation for exact syntax requirements, especially around quotes, spaces, or tags like VMC or CMC.
After changing mail servers, domains, or IP addresses, re-run DNS checks to ensure A= records update reliably and propagate across networks.

Proactive testing and maintenance

Review your CMC and VMC records at least quarterly—even small changes can break email routing if not monitored.
Before any bulk campaign, use a tool like MailTester’s inbox placement tester to simulate how your message lands in real inboxes across major providers (Gmail, Outlook, Apple).
If you’re managing large lists, run bulk verification to catch invalid or risky addresses early—especially catch-alls and role accounts that mimic valid users.
Always test with your actual sending IP and domain to catch alignment issues with SPF, DKIM, and DMARC—misconfigurations here can trigger delivery delays or blocks.

Even a single misaligned A= tag can cause consistent bounces or spam filtering. Prevention is easier than cleanup.

The bottom line: Focus on proven deliverability standards, not niche records

CMC and VMC A= tags are not part of standard email authentication today. They remain experimental or niche, used only in specialized or emerging protocols, and not yet adopted by major email providers.

Stick to the essentials

SPF, DKIM, and DMARC are the proven foundation of email deliverability. They are required by modern email infrastructure and consistently enforced by ISPs. Prioritizing these eliminates the majority of technical delivery failures.

Only consider niche records when required

CMC and VMC A= tags should only be implemented if explicitly required by a specific partner, integration, or sender agreement. Otherwise, they add complexity without measurable benefit.

Sources

52.1% of the world's top 1.8 million domains (937,931 domains) now publish a valid DMARC record, up from 29.1% in 2023. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)
Google reported 265 billion fewer unauthenticated messages sent to Gmail users in 2024 — a 65% reduction — after its bulk-sender rules took effect, with 500,000+ top domains publishing DMARC records in response. — Google (via MailOver bulk-sender requirements guide) (2024)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Is CMC DNS record the same as VMC A= tag?

No, they are not the same. CMC is a domain validation mechanism; VMC A= is a field in the Verified Message Certification protocol. They serve different functions and are not interchangeable.

Do I need a CMC DNS record for email deliverability?

Not unless specifically required by a recipient system or partner. Most senders rely on SPF, DKIM, and DMARC instead.

What happens if my VMC A= tag is incorrect?

It may trigger authentication failures, increase spam score, or reduce inbox placement, especially in high-security email environments.

How accurate is MailTester’s verification?

MailTester verifies with 98.9% accuracy, identifying valid, invalid, catch-all, and risky email addresses before delivery.

Can MailTester check CMC or VMC records?

Yes — MailTester checks the underlying domain and DNS configuration, including records relevant to domain trust, such as CMC and VMC A= tags.

Are CMC and VMC A= tags widely used?

No. They are niche technologies found in limited use, primarily within specific email certification frameworks or enterprise systems.

What’s the best way to test email deliverability?

Use Inbox Placement Testing with tools like MailTester to simulate real-world delivery across inboxes and spam filters before sending.

Do free verifications expire?

No — MailTester offers 100 free verifications to start, and any purchased credits never expire.

How does domain configuration affect sender reputation?

Proper DNS records like SPF, DKIM, and DMARC improve sender reputation. Misconfigurations can trigger distrust and delivery issues.

Which tools integrate with MailTester for list hygiene?

MailTester integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid to clean lists and prevent bounces before sending.

What is the difference between a catch-all and a valid email?

A catch-all address accepts all messages sent to the domain, even invalid addresses. A valid email is a single, deliverable inbox.

Why do some emails get blocked even with proper DNS?

Blockages can occur due to sender reputation, blacklist status, content filtering, or greylisting—even with correct DNS setup.