← All articles

Setting up SPF, DKIM and DMARC at Hetzner: konsoleH and Hetzner Console

Webhosting or managed server at Hetzner: DKIM with one click in the konsoleH mail security, the automatic default SPF, the DMARC record by hand — and where the DNS records live, depending on whether konsoleH or the Hetzner Console manages the zone.

6 min read · Updated 7 September 2026

With Hetzner webhosting and managed servers you handle DKIM and SPF in konsoleH under mail security ("Mailsicherheit"): "Enable DKIM" generates the key pair, and if the konsoleH nameservers manage the domain, Hetzner sets the DNS record and a default SPF automatically. Only DMARC you create yourself as a TXT record _dmarc — in the konsoleH DNS administration or, if the zone lives there, in the Hetzner Console under DNS.

Two interfaces, that is the pitfall: konsoleH belongs to webhosting (mailboxes, mail security, DNS administration of the hosting domains); the Hetzner Console manages cloud servers and DNS zones of domains that do not run on the konsoleH nameservers. First check which nameservers your domain has — then you know where the records belong.

Step 1: Enable DKIM in konsoleH

• In konsoleH open the hosting package and switch to mail security (Hetzner docs: the mail security settings prevent your domain from being used for forged sender addresses).
• Click "Enable DKIM" ("DKIM aktivieren") — according to the docs, Hetzner automatically generates a key pair and stores it on the mail server.
• If the domain uses the konsoleH nameservers, the public key is placed in DNS automatically.
• With external nameservers: create the TXT record shown in konsoleH by hand at your DNS provider (copy name and value exactly).

Step 2: SPF

When the konsoleH nameservers are used, Hetzner automatically sets a default SPF record for its own mail servers, according to the docs. Look at it in the DNS administration (TXT record starting with v=spf1) and use it as the basis. Hetzner explicitly warns: anyone sending via external services that are not in the record gets delivery problems — then add the services, in the same record:

With external nameservers there is no automatism: there you create the SPF record yourself, with the servers that send in your name (guide).

Step 3: DMARC

According to the Hetzner docs, DMARC is configured as a TXT record under _dmarc; Hetzner gives v=DMARC1; p=none as an example and does not create it automatically. Add a reporting address so you can see who sends in your name:

Step 4: Where the record belongs

• konsoleH nameservers: in konsoleH click the hosting name → DNS administration → DNS records; create the TXT record there. Hetzner quotes up to 24 hours until changes are effective worldwide.
• Hetzner Console (zone there): in the left menu "DNS" → select the zone → add record, choose TXT under "Type", fill in the fields, "Add".
• Third-party nameservers (e.g. Cloudflare): enter the same values there — see Mail records at Cloudflare.

Step 5: Check

After setting, check the domain from the outside — SPF syntax, DKIM selector, DMARC — and send a test email to a Gmail mailbox: "Show original" must show spf=pass, dkim=pass, dmarc=pass. That is also the way to confirm the generated selector.