Your own domain — Private.Ki Help

Q: Can I use a subdomain?

Yes. mail.yourname.com works exactly like an apex domain, and is a good choice if the main name is already serving a website with mail somewhere else.

If you own a domain name — yourname.com, or a subdomain such as mail.yourname.com — you can use it here. Mail to it arrives in this mailbox, you send from it, and your public key is published under its name so other encrypted mail programs can find it.

You add a handful of DNS records at whoever runs your domain's DNS. Nothing moves until those records are in place, and the domain stays yours throughout: the records are yours to change or remove at any time.

What it is, and what it is not

It is a set of addresses on your account. [email protected] and [email protected] become extra addresses for your mailbox. Mail to them is received, signed and sent through Private.Ki like any other mail here, and encrypted the same way.

It is not a Private.Ki domain. Nobody can sign up or sign in on your domain — not you, not anybody else. Your account is still the account you created, with the address you created it with, and that address keeps working. You cannot give somebody else an address on your domain, and there is no way to invite people onto it. If you want other people to have accounts, they sign up with their own.

One account, one domain, ten addresses

A Plus subscription allows one domain and up to ten addresses on it, plus a catch-all for every other name. The Your domain row is shown in Settings on every account, Free included — on Free it explains what you get, and the one control opens the Plus window.

What a domain must be

The setup screen checks the name before anything else. It has to be:

A whole domain name, with at least one dot. yourname on its own is a word or a top-level domain, never something a person owns.
A real ending. The part after the last dot has to be a top-level domain that exists. A typo like yourname.cmo is refused with the ending named.
Yours to control at the DNS level. Not necessarily where you pay for the name: the registrar and the DNS host can be different companies. We follow the name servers, which is where the records actually live.
Not one of ours, and not under one of ours. Addresses on a Private.Ki domain are sign-ups, not identities.
Not a public registry. co.uk, github.io and the like are endings many people share, not one person's domain.
Not already connected to another account. A domain lives on one account here at a time.

An internationalised name is accepted and stored in its xn-- form; both spellings work, and your DNS provider will show you one or the other.

Adding it

Open Settings → Your domain. Type the name and press Continue. We look at its DNS and tell you what we found: who runs it, where its mail goes today, and whether anybody has claimed it here. Nothing has changed yet. Press Add this domain to begin.
Prove it's yours. One TXT record. We look for it about once a minute while the page is open; nothing else happens until it is there. You can close the page — the check keeps running and the next step opens by itself.
Make your first address. The name before the @, and whether it becomes your default sender. You can also Skip for now and add addresses later.
Point mail here. Five records: the MX, an SPF record, two DKIM records and a DMARC record. The moment the MX record is live, mail for your domain arrives here — add the other four in the same sitting so your mail is signed and accepted everywhere.
Finishing touches. Four optional records that publish your key under your domain and announce how senders should connect to us. Worth the two minutes; Skip for now keeps them on the domain page for whenever you like.

Every record, what it does and how to type it at your provider is in DNS records for your domain.

New mail moves here; old mail stays where it is

Once the MX record points at us, mail to every address on your domain arrives in this mailbox. Whatever is already in your old mailbox stays there — nothing is imported, and nothing is copied across. If the domain was live somewhere else, export or keep access to the old mailbox before you switch.

While you wait

The checking is ours to do, and it runs on its own:

About every 30 seconds while the setup page is open, and whenever you press Check now.
Every ten minutes while we are still waiting for the ownership record.
Every five minutes for the first two days after a record changes, then hourly for a month, then every six hours once everything is in place.

A record that reads Found and then answers empty once is not taken away — it takes two empty answers in a row for us to call it Not found yet, because a nameserver that glitches for one query is common and a record you deleted is not.

When we cannot see your DNS at all

If our resolver cannot reach your DNS, the page says so: "The last check could not reach your DNS. We keep trying; nothing is wrong with your records." That is a statement about us, not about your records — it never means a record is missing, and we never act on it. Checking simply slows down and picks up again.

The domain page afterwards

Once the ownership record is seen, Your domain becomes a page about the domain, with a status pill at the top:

Pill	What it means
Waiting for the ownership record	The domain is added but not yet proven. No mail is handled for it.
Receiving	The MX record points at us. Mail to your addresses arrives here.
Not receiving	Proven, but the MX record is missing or points somewhere else. Mail is going wherever that record says.
Paused	Your subscription ended. See below.

Underneath: your Addresses, the Catch-all switch, DNS records with every record and its state, Encryption keys on this domain, and Remove this domain.

A mail record that disappears later is called out on this page. Mail for the domain may stop arriving until it is back, so it is worth reading rather than dismissing.

If your subscription ends

A domain is not deleted when Plus ends, and nothing of yours is thrown away.

The grace period. The domain keeps receiving. Renewing in this window changes nothing at all.
Then it pauses. The pill reads Paused. Sending from its addresses stops at once, and senders are asked to retry — their mail sits in their outgoing queue rather than bouncing. That lasts seven days.
After that, mail bounces. Senders get a permanent refusal and stop trying.

Renew at any point and the domain goes back to Receiving by itself, with the same addresses, the same records and the same key entries. Mail you already received is untouched the whole time — a paused domain is about new mail arriving, never about mail you have.

Removing it

Remove this domain is on the domain page, and it asks you to type the domain name exactly to confirm. What it does:

Mail to every address on the domain stops arriving here. If the MX record is still pointing at us, senders will get a bounce — so change or remove your MX record too if you want mail to go elsewhere.
Your addresses on it are removed from your account and from your key's published entries.
Mail you already received stays in your mailbox.
The domain can be connected again later, by you or by someone else.

The DNS records are yours and we never touch them. After removing, delete the ones you no longer want. If you are still on the first step and nothing has moved yet, the control is the gentler Cancel this domain instead.

What this version does not do

Said plainly, so you are not waiting for it:

No other people on your domain. No members, no invitations, no accounts for anyone else. Every address on it belongs to your account.
No DKIM key of your own. Your mail is signed with keys we hold, which is why the two DKIM records are CNAMEs pointing at us rather than a key you paste. Nothing of yours is on them, and it means we can rotate the signing keys without ever asking you to change a record.
No sign-up or sign-in on your domain, ever. That is a deliberate design decision, not a missing feature.
No mail host of your own. Your MX record names our host, not mail.yourname.com.

Will my old mail come across?

No. Nothing is imported. Mail already in your previous mailbox stays there, and only mail that arrives after the MX record changes comes here.

Can I use a subdomain?

Yes. mail.yourname.com works exactly like an apex domain, and is a good choice if the main name is already serving a website with mail somewhere else.

Do I have to add all the records?

The ownership record, yes — nothing happens without it. The MX record is what makes mail arrive. The other four mail records are what make your mail pass other people's spam checks, so in practice they are not optional either. The last four are genuinely optional and can be added whenever.

Can I keep using my Private.Ki address too?

Yes, always. Your original address never stops working, and it stays on your key. Your domain adds addresses; it does not replace one.

What if I move the domain to a different DNS provider?

Recreate the same records at the new provider. Checking carries on as usual and the page will show them as Found again once they resolve. Your addresses and your key are not affected by where DNS is hosted.

No. A domain is connected to one account. If it is already connected elsewhere, the setup screen says so and you will have to remove it from that account first.