When Rhythm sets up your Rhythm account with your own domains, your DNS administrator needs records for your member portal, event microsites, and email. Rhythm sends a DNS worksheet with the exact records to add. This article explains what the worksheet includes, how to complete it, and what happens while Rhythm waits for verification.
Who does this: Your organization’s technical contact for the new Rhythm account, or the person who manages your organization’s DNS.
When you do not need to: If your Rhythm account uses an address under one of Rhythm’s own domains, such as a sandbox under sandboxes.rhythmsoftware.com, Rhythm creates and manages the DNS for that address. Rhythm does not send a worksheet or wait for you to add records.
Prerequisites
- Your organization has given Rhythm the domains for your Rhythm account: the member portal domain, such as
members.yourassociation.org, the event microsite domain, any additional domains, and the email domain or addresses you will send from. - You can sign in to your DNS provider and add records for those domains.
- The technical contact’s email address is included on the request for your Rhythm account. Rhythm sends the worksheet there and copies the requester.
- If an outside vendor or integration asks for your Rhythm account’s identifier or sign-in domain, confirm the exact value with Rhythm. Do not assume it matches your organization’s name or a shortened version, because the two do not always match.
Warning
This worksheet covers your portal and microsite domains and your email domain. If you need to change only your portal URL and organization name later, that work is comparatively quick. Changing your sign-in domain or your account’s underlying identifier affects many more systems and teams, so it takes much longer. Plan that kind of change as a larger project and discuss timing with Rhythm well in advance.
What the Worksheet Contains
You receive the worksheet in an email titled Action Required - DNS Zone File Update. The attached spreadsheet is named for your Rhythm account and includes up to three sections:
| Section | What the records do | When it appears |
|---|---|---|
| Primary domain records | Point your member portal domain to your Rhythm portal and set up your event microsite domain | When a portal is being set up |
| Certificate ownership records | Prove to the certificate authority that you control the domains, so Rhythm can issue the secure (HTTPS) certificate for your portal and microsites | When a certificate is requested |
| Email domain records | Verify your email domain with signing (DKIM) records, so mail providers accept email Rhythm sends from it | When you send from a whole domain |
Changing your sending domain later works the same way and cannot be completed inside Rhythm alone. The new domain needs its own DNS records for authentication and branded links, so plan for DNS work and propagation time whenever you switch sending domains.
About the Certificate
Rhythm requests one wildcard certificate for your portal domain’s parent domain, your event microsite wildcard, and any additional domains. For members.yourassociation.org, the portal wildcard is *.yourassociation.org. Rhythm also adds a sandbox version of each microsite-style wildcard, such as *.events-sandbox.yourassociation.org beside *.events.yourassociation.org. This lets a future sandbox serve its microsites securely without another DNS change. Each sandbox name adds one more certificate ownership record to the worksheet.
Some DNS providers limit record length, and the sandbox versions make these records longer. If your provider rejects a record because it is too long, tell Rhythm so Rhythm can leave out the sandbox names and request the certificate again.
About Email Verification
How Rhythm verifies your sending identity depends on how your Rhythm account was set up:
- By domain (the usual way): The email domain section lists three signing records for each domain. Add them to the domain that matches your sender address. Any additional domains on the request are also verified as sending domains. These records must stay published exactly as given. Removing or changing them later can affect delivery just as much as never adding them, so keep a copy and do not let your DNS provider or a later cleanup remove them.
- By address: Each sending address receives a verification email. Someone with access to that mailbox must select the link.
Rhythm sends this mail through Amazon SES using a shared pool of sending IP addresses that changes over time. Because the IP addresses change, they are not a stable way to identify Rhythm mail; the DKIM signature is. Rhythm signs outgoing mail with your organization’s own configured sending domain using Amazon’s Easy DKIM, and a verifiable DKIM signature is enough on its own to satisfy DMARC alignment.
The worksheet does not include an SPF record, and Rhythm does not support SPF alignment for this sending approach because it would require a separate mail subdomain. DKIM signing covers alignment instead. Rhythm also does not provide sending IP addresses or an SPF include value for a mail-security allowlist. If your organization publishes SPF, manage it with your DNS provider.
Before you update DNS, confirm that the domains on the worksheet match the sending domains and sender addresses your organization actually has configured in Rhythm. If you later have deliverability problems, have the exact “from” addresses used for the affected messages ready before you contact Support. Support needs the sender address first to investigate a bounce or spam report.
Add the Records
- Open the worksheet from the Action Required - DNS Zone File Update email.
- Sign in to your DNS provider.
- For each row in each section, create the record exactly as the worksheet lists it. Copy the record name and value character for character.
- Confirm each record is published using any DNS lookup tool. Look up the record name and confirm it returns the value on the worksheet.
- If a sending address is verified by email, ask the mailbox owner to select the link in the verification email.
Result
Rhythm checks the records for you. After every email address, email domain, and the certificate are verified, the technical contact receives the DNS Zone File Update Completed email, the requester is copied, and Rhythm continues setting up your Rhythm account.
What Happens While Rhythm Waits
flowchart LR
A[Worksheet emailed] --> B[You add the records]
B --> C{Check every six hours}
C -- not yet verified --> C
C -- certificate validation timed out --> D[New certificate, new worksheet emailed]
D --> B
C -- all verified --> E[DNS Zone File Update Completed email]
- Rhythm re-checks every six hours, with no deadline, until every email address, email domain, and the certificate passes verification. Even when your records are correct, setup may not move forward until the next check, which can take a few hours.
- If the certificate authority gives up waiting, Rhythm requests a new certificate on its own and emails a new worksheet with new certificate records. Add the new records because the old certificate records no longer count.
- A verification that fails does not fix itself. If an email domain or the certificate is marked failed, revoked, or expired, setup stops progressing without a message to you. If nothing has happened for several days after you added the records, contact Support.
- Rhythm does not send reminders. Add the records as soon as you can.
If It Fails
| Symptom | Likely cause | What to do |
|---|---|---|
| Certificate still pending after you added the records | A certificate ownership record is missing or mistyped, or Rhythm has not run the next six-hour check yet | Look up each record, then wait for the next six-hour check |
| You received a second worksheet with different records | The first certificate’s validation timed out, so Rhythm requested a new one | Add the records from the newest worksheet |
| Email from your domain is rejected or lands in spam | The signing records were added to a domain that does not match your sender address, or they were not added | Add the signing records to the domain that matches your sender address |
| Your DNS provider refuses a certificate record as too long | The sandbox version makes the record too long | Ask Rhythm to leave the sandbox names off the certificate |
| Email fails after you change your sender address to a new domain | The new address or domain has not been verified | Verify the new sender before using it; a new domain needs its own signing records |
| Emails are rejected or marked as spam right after you switch your visible From address to a new domain | You changed the visible sending domain before its authentication was fully aligned, so the signing domain and the From address did not yet match | Use a previously verified sender on an already-aligned domain until the new domain’s signing records are added and verified, then switch |
| You are changing your organization’s sending domain and want to know what happens | Rhythm generates new DNS authentication records for the new domain and sends them to you. Rhythm validates them, activates the new domain only after that, and then moves your transactional and portal outbound email to it | Add and verify the new records first; do not expect the new domain to send mail until Rhythm confirms it is active |
When you contact Support, include the Rhythm account name, the worksheet you worked from, the records you added, and the results of your DNS lookups.