Adding DMARC, SPF, and DKIM records in Hostinger

Before you start: confirm Hostinger answers your DNS

Hostinger's default nameservers are ns1.dns-parking.com and ns2.dns-parking.com (a pair, with no ns3 or ns4). Note that they end in dns-parking.com, not hostinger.com, which is a common mismatch. Confirm:

dig +short NS yourdomain.com

If the answers end in dns-parking.com, Hostinger answers your DNS and the DNS Zone Editor is the right place.

Step 1: Open the DNS Zone Editor

There are two ways in, depending on your account:

• Domain only: hPanel, then Domains, then Domain portfolio, select the domain, then DNS / Nameservers, then DNS records.
• With a hosting plan: hPanel, then Websites, select the site, then Advanced, then DNS Zone Editor.

Both land on the same add-record form.

Step 2: Add the record

Set Type to TXT, put the host in the Name field (@ for the root, or a prefix), and paste the value into the TXT value field.

DMARC

Type:      TXT
Name:      _dmarc
TXT value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
TTL:       14400

Start at p=none, then move past p=none once your reports are clean.

SPF

Type:      TXT
Name:      @
TXT value: v=spf1 include:_spf.yourprovider.com ~all
TTL:       14400

Keep a single v=spf1 record. Publishing two is a permanent error that makes every sender fail SPF, so edit the existing record rather than adding a second.

DKIM

Type:      TXT
Name:      selector._domainkey
TXT value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)
TTL:       14400

Paste the whole key as one value and do not add quotes of your own. If the editor refuses a long key, ask your sending provider for the key split into quoted strings of 255 characters or fewer.

MTA-STS pointer

Type:      TXT
Name:      _mta-sts
TXT value: v=STSv1; id=20260623000000
TTL:       14400

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) is the same shape. Hostinger's default TTL is 14400 seconds (4 hours); lower it to 300 while testing if you want faster propagation.

Hostinger quirks that bite

• One email subscription per domain. Hostinger links each domain and its mailboxes to a single email subscription. Setting up Hostinger Email, Titan, or Google Workspace through hPanel adds the MX, SPF, and DKIM records for that service. If you are switching to a different sender, delete the stale MX records first and merge SPF rather than adding a second one.
• External nameservers. If your domain points its nameservers somewhere other than dns-parking.com, the hPanel DNS Zone Editor is not authoritative and your edits will not take effect. Edit at the provider your NS records point to.
• The full domain in the Name field. Enter _dmarc, not _dmarc.yourdomain.com. Hostinger appends the domain.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. The record is live the moment the lookup returns it; other resolvers catch up as the old TTL expires.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the change resolves. We read the record again from public DNS and refresh the page.