Yes. Even if you never send an email from @kokhost.com, you should set up basic records for it to prevent others from spoofing your server's name and to improve your server's reputation.
Here is the short list of records you need:
These records identify your "hardware" to the world. This is configured once during the initial server setup; it is not created for each sending domain.
mail.kokhost.com → [Your Server IP] (Mandatory).
[Your Server IP] → mail.kokhost.com. (Mandatory – set this in your VPS provider's dashboard, not your DNS manager).
v=spf1 a -all (Recommended – tells the world this domain only sends mail from its own IP, or none at all).
v=DMARC1; p=reject; (Recommended – prevents anyone else from using your server's domain name).
These records allow your server to send and receive mail for your users.
@ → mail.kokhost.com (Priority 10).
v=spf1 mx a:mail.kokhost.com -all (Mandatory).
./setup.sh email add user@yourdomain.tld
./setup.sh config dkim domain 'yourdomain.tld'
Then open config/opendkim/keys/yourdomain.tld/mail.txt, copy the TXT value into DNS as mail._domainkey, and restart the mailserver container.
v=DMARC1; p=quarantine; (Mandatory).
Do you need DKIM for kokhost.com? No, because you aren't signing emails with that domain.
Do you need SPF/DMARC for kokhost.com? Yes. It’s a "security lock" for your server's name so spammers can't impersonate your server.
Deliverability: Major providers (Gmail/Outlook) check if the Sending Domain (codingpanda.com) is fully authenticated and if the Server Host (mail.kokhost.com) has a valid A and PTR record (set once at install time, not per domain).