Setting up SPF, DKIM and DMARC at Strato: step by step
Domain at Strato: the click path to DNS management, the predefined SPF and DMARC rules, custom TXT records with prefix and value — and how DKIM works at Strato.
At Strato, SPF, DKIM and DMARC live in the customer login under Domains → "Domainverwaltung" [domain management] → gear icon of the domain → "DNS" tab → "TXT- und CNAME-Records verwalten" [manage TXT and CNAME records]. Strato offers predefined SPF and DMARC rules there; if you need your own values (for Microsoft 365, Google Workspace or a newsletter service, say), choose "Keine STRATO SPF-Regel" [no STRATO SPF rule] or "Keine STRATO-DMARC-Regel" [no STRATO DMARC rule] and enter a custom TXT record. DKIM is signed automatically by Strato for mail sent through its own mail servers.
This applies to domains whose nameservers are at Strato (the usual case). If your domain is registered at Strato but its DNS is managed elsewhere, e.g. at Cloudflare, set the same values there.
Step 1: Open DNS management
- In the Strato customer login, go to Domains → "Domainverwaltung".
- Click the gear icon next to the domain in question.
- Open the "DNS" tab and click "TXT- und CNAME-Records verwalten".
- Save every change with "Einstellung übernehmen" [apply setting].
Step 2: SPF
Strato offers predefined SPF rules for its own mail server (called "Standard STRATO Mailserver" in its spam FAQ, with a fail and a softfail variant). If you send exclusively via Strato mailboxes, that selection is enough. As soon as a second service sends with your domain, you need your own record: activate "Keine STRATO SPF-Regel", leave the prefix empty, type TXT, and name all senders in ONE record as the value:
your-domain.dev=spf1 include:_spf.strato.com -allWhat the value looks like for several services, and why there may be only one SPF record, is explained in Creating an SPF record and Several sending services in one SPF.
Step 3: DKIM
For mail that goes through the Strato mail servers (smtp.strato.de), Strato states in its own FAQ that all outgoing mail is signed with DKIM automatically — there is nothing to enter and nothing to activate. The public key lives under the selector strato-dkim-0002 (verified via DNS: strato-dkim-0002._domainkey.strato.de). If you use an external sending service (newsletter, shop, Microsoft 365, Google Workspace), that service signs itself — then you create its DKIM records (usually CNAME) in the same form: prefix e.g. selector1._domainkey, type CNAME, value as provided by the service.
Step 4: DMARC
According to Strato, DMARC is already activated for domains with Strato DNS: in the DNS tab the "STRATO-DMARC-Regel" is preselected. The FAQ does not say which policy it sets exactly — check the actual value from the outside (below). For your own rule — for instance with a reporting address, as the step-by-step plan recommends — choose "Keine STRATO-DMARC-Regel" and enter:
_dmarc.your-domain.dev=DMARC1; p=none; rua=mailto:dmarc@your-domain.deWhat each parameter means is explained in The DMARC record explained.
Step 5: Wait and check from the outside
Strato quotes up to 24 hours until DNS changes are fully active; it is usually faster. Afterwards, check the whole chain once from the outside — SPF syntax, DKIM discoverability, DMARC policy — instead of relying on what the form displays. In addition, send a test email to a Gmail mailbox and open "Show original" there: spf=pass, dkim=pass, dmarc=pass.
Frequently asked questions
Where do I find the DNS settings at Strato?
In the customer login under Domains → "Domainverwaltung", then open the "DNS" tab via the gear icon of the domain. TXT and CNAME records are behind "TXT- und CNAME-Records verwalten", MX records next to it under "MX-Record".
Which SPF record do I need for Strato mailboxes?
Either the predefined Strato SPF rule in the DNS tab, or as a custom record v=spf1 include:_spf.strato.com -all. As soon as another service sends with your domain, it must go into the SAME record — a second SPF record alongside it makes the check invalid.
Do I have to set up DKIM at Strato myself?
Not for mail sent through the Strato mail servers — Strato signs automatically. You only need your own DKIM records for external sending services (newsletter, shop, Microsoft 365, Google Workspace); enter their CNAME or TXT values in the same form.
How do I create a DMARC record at Strato?
In the DNS tab choose "Keine STRATO-DMARC-Regel", then enter prefix _dmarc, type TXT and as the value e.g. v=DMARC1; p=none; rua=mailto:dmarc@your-domain.de, and save with "Einstellung übernehmen". Wait up to 24 hours, then check from the outside.
Can I leave the domain at Strato and only move the DNS elsewhere?
Yes — to do so, switch the domain's nameservers to the new DNS provider (e.g. Cloudflare). The domain stays registered at Strato; you then manage the records there. Before the move, copy down the existing zone completely and do not forget the DKIM CNAMEs for Strato mailboxes.
Which nameservers does my Strato domain have, and why does it matter?
The nameservers are listed in the customer login at the domain (DNS tab or nameserver settings) — for Strato domains normally Strato's own. Only then do the Strato rules for SPF, DKIM and DMARC from this guide apply; if the nameservers point to another provider, enter the values there.