Adding DMARC, SPF, and DKIM records in IONOS

Before you start: confirm IONOS answers your DNS

IONOS assigns four nameservers across four top-level domains, of the form ns1NNN.ui-dns.de, .biz, .org, and .com (the NNN is a number unique to your domain). Confirm:

dig +short NS yourdomain.com

If the answers end in ui-dns.*, IONOS answers your DNS. If your domain points its nameservers elsewhere, edit your records there instead.

Step 1: Open the DNS settings

1. Sign in to IONOS and open Domains & SSL.
2. For the domain you want, open the menu under Actions (shown as a gear or a three-dots icon depending on your panel version) and choose DNS.
3. Select Add Record and pick the record type.

Step 2: Add the record

The TXT form has a Type dropdown, a Host name field, a Value field, and an optional TTL. Use @ in Host name for the root domain, or a prefix for everything else. IONOS appends your domain, so enter only the prefix.

DMARC

Type:      TXT
Host name: _dmarc
Value:     v=DMARC1; p=none; rua=mailto:you@yourdomain.com

IONOS creates _dmarc.yourdomain.com for you from the _dmarc host name. Start at p=none, then move past p=none once your reports are clean.

SPF

IONOS has a dedicated IONOS SPF (TXT) entry in the Add Record menu for IONOS-hosted mail, and it auto-supplements any SPF record you already have rather than making you write one. For a third-party sender, add a plain TXT instead:

Type:      TXT
Host name: @
Value:     v=spf1 include:_spf.yourprovider.com ~all

Either way, keep a single v=spf1 record. If one already exists, edit it rather than adding a second.

DKIM

How DKIM works on IONOS depends on who sends your mail. With IONOS mail on IONOS nameservers, DKIM is set up with CNAME records (often automatically), not a pasted key. With a third-party sender, your provider gives you a TXT key to publish:

Type:      TXT
Host name: selector._domainkey
Value:     v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)

Paste the whole key as one value. Confirm it resolved with our DKIM verifier afterward.

MTA-STS pointer

Type:      TXT
Host name: _mta-sts
Value:     v=STSv1; id=20260623000000

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com, which trustyourinbox can host. TLS-RPT (_smtp._tls) is the same shape.

IONOS quirks that bite

• Don't add a second SPF record. IONOS folds its own sending into your existing SPF automatically. If you need a third-party include, edit the one record rather than creating another.
• DKIM is a CNAME for IONOS mail. If your mailbox is IONOS-hosted, do not paste a DKIM TXT; IONOS manages it. The TXT route above is for third-party senders.
• External nameservers. If your domain points its nameservers away from IONOS, the IONOS DNS panel is not authoritative. Edit at the provider your NS records point to.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. IONOS applies changes quickly, though they can take up to an hour to appear everywhere.

Tell trustyourinbox to recheck

Each per-domain protocol tab has a Recheck button next to the current record. Click it once the change resolves and we re-run the lookup and refresh the dashboard.