← All articles

Setting up SPF, DKIM and DMARC at IONOS: step by step

Domain at IONOS (1&1): the click path to the DNS settings, the ready-made record type "IONOS SPF (TXT)", automatic DKIM including the CNAMEs for external nameservers — and the DMARC record IONOS does not create for you.

6 min read · Updated 7 September 2026

At IONOS the mail records live in the customer account under Domains & SSL: next to the domain, under "Actions", click the icon (gear or three dots, depending on the interface) → "DNS" → "Add record". SPF is available there as a ready-made record type "IONOS SPF (TXT)", DKIM is set up automatically by IONOS when its nameservers are used — only DMARC has to be created by you as a TXT record with host name _dmarc. Changes are active at IONOS immediately and, according to IONOS, visible everywhere within an hour.

This applies to domains using the IONOS nameservers (the default). If the DNS is elsewhere — at Cloudflare, say — enter the values from steps 2 to 4 there.

Step 1: Open the DNS settings

• In the IONOS customer account, go to Domains & SSL (Domain Center).
• Next to the domain, under "Actions", click the icon and choose "DNS".
• Click "Add record"; choose the record type under "Type".
• Fill in the fields (host name, value, optional TTL) and confirm with "Save".

Step 2: SPF

IONOS creates the SPF record for its own mail servers on IONOS domains by itself. If it is missing, choose the type "IONOS SPF (TXT)" under "Add record" and save — that is all. According to IONOS, an existing SPF record of another service is automatically supplemented with the IONOS servers. The record points to an IONOS include:

How several services fit into one record and why there must never be two SPF records: Creating an SPF record and Several sending services in one SPF.

Step 3: DKIM

If you use the IONOS nameservers, DKIM for IONOS mailboxes is already set up according to IONOS — there is nothing to click. Only if your domain's DNS is with another provider do you create three CNAME records there that point to the keys at IONOS:

External sending services (newsletter, shop, Microsoft 365, Google Workspace) sign themselves — create their DKIM records via "Add record" → type CNAME (or TXT) with the values provided by the service.

Step 4: DMARC

IONOS does not create a DMARC record by itself. "Add record" → type TXT → host name _dmarc → value as below → "Save". IONOS gives p=none for observing and p=reject as the goal as examples; start with p=none and a reporting address, as the step-by-step plan recommends:

Step 5: Check

IONOS states that changes take effect immediately and need up to an hour to arrive everywhere (the SPF article mentions up to 48 hours). Then check the domain from the outside — SPF syntax, DKIM selectors, DMARC — and send a test email to a Gmail mailbox: "Show original" must show spf=pass, dkim=pass, dmarc=pass.