Adding DMARC, SPF, and DKIM records in DigitalOcean

Before you start: add the domain and delegate it

DigitalOcean DNS only works once two things are true: the domain is added under Networking, Domains, and your registrar's nameservers point to DigitalOcean's three: ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com. Confirm the delegation:

dig +short NS yourdomain.com

If the answers are the three digitalocean.com nameservers, you are set. If not, records you add here will not resolve until the delegation is in place.

Step 1: Open the domain

1. In the DigitalOcean control panel, go to Networking, then Domains.
2. Select your domain (or add it first).
3. Choose Create a record and select the TXT type.

Step 2: Create the record

A TXT record has a Hostname, a TXT Value, and a TTL. Use @ in Hostname for the root domain, or a prefix for everything else.

DMARC

Hostname:  _dmarc
TXT Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
TTL:       1800

Start at p=none, then move past p=none once your reports are clean. DigitalOcean's minimum TTL is 30 seconds; a record saved without one takes the zone's SOA TTL. The 1800 in these examples is a sensible choice, not a default.

SPF

Hostname:  @
TXT Value: v=spf1 include:_spf.yourprovider.com ~all
TTL:       1800

Keep a single v=spf1 record. Since DigitalOcean adds nothing for email, you are starting clean, so just do not create a second one later.

DKIM (mind the length)

A single DNS string maxes out at 255 characters, and DigitalOcean's docs do not say the panel splits a long DKIM key for you. If it refuses the whole key, break it into chunks of 255 or fewer, wrap each in double quotes, and put them together in the one TXT Value field:

Hostname:  selector._domainkey
TXT Value: "v=DKIM1; k=rsa; p=MIIBIjANBgkq...first255" "...rest of the key"
TTL:       1800

Keep it as one record, not two. The strings concatenate back together at lookup time. Our DKIM verifier confirms the result parses.

MTA-STS pointer

Hostname:  _mta-sts
TXT Value: v=STSv1; id=20260623000000
TTL:       1800

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) is the same shape.

Doing it from doctl or Terraform

DigitalOcean DNS is just as often managed in code. Check how each tool wants the record name: the doctl reference writes the apex as the full domain name, while Terraform's digitalocean_record takes the relative name (_dmarc, or @ for the apex). Whichever you use, the same one-SPF-record and DKIM-length rules apply.

DigitalOcean quirks that bite

• A long DKIM key entered as two records. The two quoted strings go in one TXT Value field, not two separate TXT records at the same hostname. Two records at one selector are the same failure as two SPF records: receivers cannot tell which key to use, and the signature fails.
• The full domain in the Hostname field. Hostname takes the prefix only (_dmarc, @, selector._domainkey). Typing _dmarc.yourdomain.com creates the record at _dmarc.yourdomain.com.yourdomain.com, which never resolves.
• A record added before delegation finished. If dig +short NS yourdomain.com still answers with your registrar's nameservers rather than DigitalOcean's three, nothing you add here resolves. The record is saved and correct; it is simply not the zone the internet is asking.
• Checking too soon after an edit. A resolver can keep serving the old value until the record's TTL runs out (30 minutes at the 1800 used above). An unchanged dig result right after saving usually means the cache, not a mistake. Lower the TTL before a planned change if you need it to turn over faster.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. A split DKIM key shows up as one continuous value once the resolver stitches the strings back together.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the change resolves. We read the record again from public DNS and refresh the page.