If you have ever watched a Money Robot run stall on mailbox verification, the culprit is often not the mail server at all. It is the DNS record TTLs sitting in front of it. When you buy a catch-all email for Money Robot on a shared subdomain, you are renting space inside someone else’s zone, and their TTL choices become yours. That single architectural fact shapes how fast SPF, DKIM, and MX changes propagate, and how quickly the submitter can start registering accounts against fresh addresses.
The two provisioning models look similar on an invoice and behave very differently under load. A shared subdomain typically starts at $0.49 per month and gives you a working catch-all mailbox in minutes, but the parent zone’s caching policy governs how long resolvers hold onto stale records. A dedicated catch-all domain hands you the zone file, which means you can set a 300-second TTL on an SPF TXT record while leaving MX at 3600 and DKIM selectors somewhere in between. That control matters once you are rotating dozens of Money Robot email accounts and need confirmation links from Web 2.0 blogs, wiki signups, and bookmarking sites to land in the right mailbox without delay.
This part of the guide digs into the mechanics behind that difference: how delegation under a provider-controlled parent zone propagates aggressive TTLs to records you never touched, why a stale negative cache entry can make a freshly provisioned address look dead to Money Robot, and what changes when AllMail provisions DNS automatically inside a zone you actually own. Along the way you will see concrete record patterns, the role of the POP3 server at mail.allmail.one on port 995 with SSL/TLS, and why a 14-day retention window on the catch-all mailbox is worth planning around rather than discovering mid-campaign.
Dedicated vs. Shared Catch-All Domain Provisioning: How the Architecture Differs
Money Robot Submitter builds backlinks by registering accounts across Web 2.0 blogs, article directories, wiki signups, bookmarking sites, and profile pages. Every one of those registrations needs an email address that can receive a confirmation link. That is why the catch-all domain you point at the tool matters more than most people assume. The provisioning model behind that domain decides how much control you have over DNS, and DNS is where SPF, DKIM, and MX TTL actually live.
There are two ways to get a catch-all domain for Money Robot. You can rent space on a shared catch-all that sits on a subdomain of a provider-controlled parent zone, or you can own a dedicated catch-all with its own zone and your own nameservers. Both accept mail to any address at the domain. The difference is who holds the zone file.
What a Shared Catch-All Actually Gives You
A shared catch-all domain looks like yourname.mailprovider.net. The provider owns mailprovider.net, runs the authoritative nameservers, and delegates your subdomain as a slice of that parent. You get a mailbox login and a POP3 hostname, usually something like mail.allmail.one, plus the promise of unlimited email addresses under your prefix. What you do not get is the zone. The SOA record, the default TTL, and the parent’s caching policy all belong to someone else.
This model is cheap and fast to start. A shared subdomain starts at $0.49 per month, DNS provisioning is automatic, and you never touch a registrar. For someone spinning up a few hundred Money Robot email accounts for wiki signups and bookmarking sites, it works. The trade-off shows up later, when a record change has to propagate and you have no lever to pull.
A dedicated catch-all is the opposite arrangement. You register the domain, point it at authoritative nameservers you control, and publish every record yourself: the MX that routes mail to the catch-all mailbox, the SPF TXT record, and each DKIM selector. Because the zone is yours, each record type carries its own TTL value that you set and can lower on demand. Nothing is inherited from a parent you do not administer.
Zone ownership is the root of every downstream DNS difference between the two models. Here is what changes when you hold the zone:
- TTL authority. You choose the TTL on SPF, DKIM, and MX records individually instead of accepting whatever the parent zone publishes.
- Propagation speed. Dropping a record TTL to 300 seconds before a change means resolvers pick up the new value in minutes, not hours.
- Record isolation. A misconfigured SPF record on a shared parent can affect every tenant under it. On your own zone, the blast radius is your domain.
- Selector flexibility. DKIM selectors are just DNS names. Owning the zone lets you rotate selectors whenever you rotate signing keys.
- Provider portability. You can move the catch-all mailbox to a new host by editing MX records alone, without migrating to a new subdomain.
There is a real cost to the dedicated route. You handle DNS provisioning yourself, which means creating records by hand or through an API, and you pay registrar fees on top of the mailbox service. AllMail provisions DNS automatically for its own domains, but a dedicated zone you bring yourself is your responsibility to configure.
Neither model is wrong. A shared subdomain is fine when you want low friction and your record set rarely changes. A dedicated zone earns its keep the moment you need to tune SPF, DKIM, and MX TTL independently, because on a shared parent those values are not yours to set. That distinction drives everything that follows about propagation and Money Robot POP3 setup.
Why Shared Subdomains Inherit Aggressive Parent DNS TTLs
A shared catch-all domain almost never gives you a zone of your own. It gives you a subdomain, something like yourname.allmail.one, delegated inside a parent zone the provider runs. That parent zone carries a default TTL, and whatever value the provider picked applies to the NS delegation and to any record the panel writes for you. If the parent runs at 300 seconds, your SPF TXT, DKIM selector, and MX records sit in resolver caches for five minutes at a time. If it runs at 3600, you wait an hour for every edit. You did not choose that number, and the provider will not change it for one customer.
The damage shows up at the worst moment: first contact with Money Robot Submitter. The tool builds backlinks by registering accounts, and before it registers anything it checks the mailbox. It reads MX, looks up the SPF TXT, and probes the DKIM selector. If you just created the catch-all domain and the resolver still holds a negative or old answer from the parent’s TTL window, the check fails. The mailbox exists, the catch-all mailbox accepts mail to any address at the domain, but Money Robot sees no MX and marks the account unverified. You retry, get the same stale answer, and burn an hour chasing a problem that is pure cache age.
There is a second layer. Shared parents are busy. Hundreds of subdomains, thousands of lookups per minute, and providers tune their nameservers for throughput, which usually means longer TTLs on stable records and short ones on anything they might reshuffle. Either way you inherit the policy. A TTL of 60 on the parent’s NS set means the delegation itself can flap between nameserver pairs during maintenance, and your records briefly resolve against a zone that has not caught up. A TTL of 86400 means a DKIM key rotation takes a day to reach resolvers that already cached the old selector.
Compare the realistic options before you commit a Money Robot workflow to a shared subdomain.
| Provisioning option | Typical TTL you get | Who controls SPF, DKIM, MX TTL | Effect on Money Robot mailbox validation |
|---|---|---|---|
| Shared subdomain, provider default | 300 to 3600 seconds, inherited from parent | Provider | Stale answers delay verification after any record change |
| Shared subdomain, provider raises TTL on request | Rarely offered, often 3600 fixed | Provider, negotiated | Faster steady state, slower every edit |
| Dedicated catch-all domain, default zone | You set it, commonly 300 to 600 | You | Predictable propagation, retries clear in minutes |
| Dedicated catch-all domain, tuned per record | 60 on MX and SPF during setup, 3600 after | You | Fast cutover, then stable caching |
| Dedicated domain with external DNS host | Any value the host allows, down to 60 | You and the host | Full control, but you own every mistake |
One more wrinkle: negative caching. When Money Robot queries a DKIM selector that does not exist yet, the resolver caches the NXDOMAIN or empty answer for the TTL of the parent’s SOA minimum. On a shared parent that minimum can be an hour. You publish the selector two minutes later and the tool still gets “no key” until the negative entry expires. On your own zone you set the SOA minimum to 300 and the same sequence resolves in five minutes.
None of this makes shared subdomains useless. At $0.49 per month for a shared subdomain, they are the cheapest way to test whether a catch-all strategy works at all. Money Robot submitter email has more details on this topic. Just know what you are buying: a mailbox on someone else’s clock. The moment you need SPF, DKIM, and MX TTL values that answer to you, the parent zone stops being a convenience and becomes the bottleneck.
Setting SPF, DKIM, and MX TTL Independently on Your Own Domain
Owning the zone changes the whole job. On a dedicated catch-all domain you point the registrar at authoritative nameservers you actually control, and from that moment every TTL is a decision you make rather than one you inherit from a provider’s parent zone. If the registrar offers its own DNS, you can use it, but a third-party authoritative pair (Cloudflare, Bunny, Route 53, or the nameservers your mail host hands you) gives you cleaner control over per-record TTLs and easier auditing. AllMail, for example, provisions DNS automatically when you add a domain, which is fine for a quick start, but the settings below are what you want to verify once the zone is yours.
Start with the MX record. For a catch-all domain that accepts mail to any address at the domain, a single MX pointing at the provider’s inbound host is enough. Set the TTL deliberately: 300 seconds (5 minutes) while you are still testing, then 3600 once things settle. A short TTL during rollout means a wrong hostname is fixed in five minutes instead of an hour. Publish only one MX unless the provider explicitly gives you a backup, and keep the priority at 10.
The SPF record is a TXT record at the apex. The pattern Money Robot and similar tools expect is a single SPF TXT that authorizes your sending infrastructure and ends in a hard or soft fail:
- Name: @ (apex)
- Type: TXT
- Value: v=spf1 include:mail.allmail.one -all
- TTL: 3600
Keep exactly one SPF record per name. Two SPF TXT records at the apex is a permanent error and receivers will treat the domain as having no valid policy. If you later add a second sender, edit the existing record with a second include rather than creating a new one. SPF TTLs can be longer than MX because the record rarely changes; 3600 is a sensible default, and you can drop to 600 for the first day after any edit.
DKIM is where selector-level TTLs matter. Each selector is its own TXT record at selector._domainkey, so you can give a fresh selector a short TTL while it is being validated and leave older selectors at 3600. A typical record looks like this:
| Name | Type | Value | TTL |
|---|---|---|---|
| mr1._domainkey | TXT | v=DKIM1; k=rsa; p=MIGfMA0GCSq… (public key) | 600 |
| mr2._domainkey | TXT | v=DKIM1; k=rsa; p=MIGfMA0GCSq… (public key) | 3600 |
Rotating selectors (mr1, mr2, mr3) is standard practice when you run many Money Robot email accounts from one catch-all domain: each batch of accounts signs with its own selector, and if one key gets burned you retire that selector without touching the others. Keep the private keys with the sending service, never in the zone.
Two more records round out the zone. A DMARC TXT at _dmarc with p=none while you monitor, then p=quarantine once DKIM alignment is clean, TTL 3600. And an A or CNAME for the mail host if the provider asks for one, usually at mail.yourdomain.com. Once these are live, the catch-all mailbox will accept mail to any address at the domain, which is what makes unlimited email addresses practical for registration addresses across Web 2.0 blogs, article directories, wiki signups, bookmarking sites, and profile pages.
One trade-off worth stating plainly: shorter TTLs cost you more DNS queries and slightly slower resolution for every mailbox login, but they cut propagation time from hours to minutes. During the first week of a new dedicated domain, run everything at 300 to 600 seconds. After the zone has been stable for a few days and Money Robot has validated the mailboxes, raise SPF, DKIM, and MX to 3600 and leave them there.
Validating Money Robot POP3 Setup and Mailbox Scale After Propagation
The DNS panel says “saved.” That means nothing yet. Before you touch Money Robot, confirm the records are actually answering from the authoritative servers your zone delegates to. Run dig against the nameserver directly so you bypass any resolver cache still holding the old TTL:
- MX:
dig MX yourdomain.com @ns1.yourhost.com +shortshould return the mail exchanger pointing at the catch-all mailbox provider. - SPF:
dig TXT yourdomain.com @ns1.yourhost.com +shortshould show a single v=spf1 record with the include for your mail host. Two SPF records is a fail, not a merge. - DKIM:
dig TXT selector._domainkey.yourdomain.com @ns1.yourhost.com +shortshould return the public key. Use the exact selector string the provider issued.
Then repeat each query without the @ns flag to see what public resolvers return. If the authoritative answer is correct but the recursive answer is stale, you are waiting out the TTL you set in the previous step. With MX at 300 seconds, that is five minutes. With the default 3600, it is an hour of Money Robot failing to verify mailboxes for no visible reason.
Once the public lookups match, open the catch-all mailbox settings in Money Robot and enter the POP3 details. The POP3 server is mail.allmail.one, and the POP3 port is 995 with SSL/TLS. If your client or tool prefers IMAP, the IMAP port is 993 with SSL/TLS. Use the mailbox login credentials exactly as provisioned, including the full address as the username if that is what the provider issued. Leave the “leave a copy on server” option on for the first test run so you can inspect what arrived.
Now test the loop end to end. Trigger a signup on a throwaway service, let the confirmation email land at a random address on your catch-all domain, and confirm Money Robot pulls it and follows the link. Do this three times with three different addresses to prove the catch-all is accepting mail to any address at the domain, not just the one you configured. Check the mailbox web interface as well so you can see raw headers and confirm SPF and DKIM pass on delivery.
Scale is where TTL choices get tested. Spin up a batch of Money Robot email accounts, point them at the same catch-all mailbox, and watch the verification success rate over the next hour. If new addresses resolve slowly, your MX TTL is too high for the pace at which you rotate registrations. If you are churning through hundreds of signups a day across Web 2.0 blogs, article directories, wiki signups, bookmarking sites, and profile pages, drop MX to 300 and keep SPF and DKIM TXT records at 3600 since they change rarely. The catch-all mailbox retains email for 14 days, so build your retrieval schedule inside that window or confirmation links expire unread.
One last check: after 24 hours, re-run the dig commands and confirm nothing reverted. Some providers silently rewrite records during DNS provisioning. Compare the TTL values in the answer section against what you set. If they drifted, fix them now, before the account list grows and a single stale record stalls an entire batch.
Before you touch another Money Robot campaign, run one test that tells you whether your DNS is actually yours to control. Query the SPF TXT record, a DKIM selector, and the MX record for your catch-all domain, then compare the TTL values and the nameservers in the answers. If the nameserver belongs to a provider parent zone and the TTLs come back at values you never set, you are on a shared subdomain and every mailbox you register inherits that caching behavior. If the zone answers from your own authoritative nameservers with the TTLs you configured, you are clear to scale. Do the same check against the shared option at $0.49 per month for a shared subdomain and you will see the difference in the answer section within seconds.
Then put the domain to work. Point Money Robot POP3 setup at mail.allmail.one on port 995 with SSL/TLS, or use IMAP on port 993, and let a batch of signups run across Web 2.0 blogs, article directories, wiki signups, bookmarking sites, and profile pages. Watch the catch-all mailbox for email confirmation links and confirm they land and stay readable within the 14-day retention window. If links arrive late or mailbox logins fail, the culprit is almost always a stale MX or TXT record, not the account itself, so re-check propagation before you blame the submitter. Keep the TTLs short during the first week of a new batch of Money Robot email accounts, lengthen them once verification is stable, and pay with USDT or USDC if you want provisioning to finish in the same sitting as your DNS edits. A dedicated catch-all domain costs more than a shared subdomain, but the control over SPF, DKIM, and MX TTL is what keeps registration addresses alive long enough to matter.