Adding DMARC, SPF, and DKIM records in IONOS

Before you start: confirm IONOS answers your DNS

IONOS assigns four nameservers across four top-level domains, of the form ns1NNN.ui-dns.de, .biz, .org, and .com (the NNN is a number between 016 and 126 that varies by domain). Confirm:

dig +short NS yourdomain.com

If the answers end in ui-dns.*, IONOS answers your DNS. If your domain points its nameservers elsewhere, edit your records there instead.

Step 1: Open the DNS settings

1. Sign in to IONOS and open Domains & SSL.
2. For the domain you want, open the menu under Actions (shown as a gear or a three-dots icon depending on your panel version) and choose DNS.
3. Select Add Record and pick the record type.

Step 2: Add the record

The TXT form has a Type dropdown, a Host name field, a Value field, and an optional TTL. Use @ in Host name for the root domain, or a prefix for everything else. IONOS appends your domain, so enter only the prefix.

DMARC

Type:      TXT
Host name: _dmarc
Value:     v=DMARC1; p=none; rua=mailto:you@yourdomain.com

IONOS creates _dmarc.yourdomain.com for you from the _dmarc host name. Start at p=none, then move past p=none once your reports are clean.

SPF

IONOS has a dedicated IONOS SPF (TXT) entry in the Add Record menu for IONOS-hosted mail; choose it and IONOS writes the record for you (v=spf1 include:_spf-us.ionos.com ~all for a US account, _spf-eu.ionos.com for a UK or EU one). For a third-party sender, add a plain TXT instead:

Type:      TXT
Host name: @
Value:     v=spf1 include:_spf.yourprovider.com ~all

Either way, keep a single v=spf1 record. If one already exists, add the extra include: to it rather than adding a second record.

DKIM

How DKIM works on IONOS depends on who sends your mail. With IONOS mail on IONOS nameservers, DKIM is three CNAME records that IONOS sets up for you, not a pasted key (if your DNS lives elsewhere, IONOS shows you the three CNAMEs to add there). With a third-party sender, your provider gives you a TXT key to publish:

Type:      TXT
Host name: selector._domainkey
Value:     v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)

Paste the whole key as one value. Confirm it resolved with our DKIM verifier afterward.

MTA-STS pointer

Type:      TXT
Host name: _mta-sts
Value:     v=STSv1; id=20260623000000

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) is the same shape.

IONOS quirks that bite

• Don't add a second SPF record. If the IONOS SPF entry already put one on the domain, add your third-party include: to that record rather than creating another.
• DKIM is a CNAME for IONOS mail. If your mailbox is IONOS-hosted, do not paste a DKIM TXT; IONOS manages the three CNAMEs. The TXT route above is for third-party senders.
• External nameservers. If your domain points its nameservers away from IONOS, the IONOS DNS panel is not authoritative. Edit at the provider your NS records point to.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. IONOS publishes the change to its nameservers; other resolvers catch up as the old TTL expires.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the change resolves. We read the record again from public DNS and refresh the page.