Adding DMARC, SPF, and DKIM records in OVHcloud

OVHcloud adds records through a short Add an entry form, and the apex sub-domain is left blank rather than typed as @. Here is the path through the DNS zone, the records to add, and the one button not to click.

Verified 2026-06-23 against the official OVHcloud documentation.

Before you start: confirm OVHcloud answers your DNS

OVHcloud assigns each domain a pair of nameservers in the ovh.net family, of the matched form dnsNN.ovh.net and nsNN.ovh.net (the NN is a number with no special meaning). Confirm:

dig +short NS yourdomain.com

If the answers end in ovh.net, the OVHcloud DNS zone is the right place. If you have pointed the domain at external nameservers, edit your records there instead.

Step 1: Open the DNS zone

Sign in to the OVHcloud Control Panel and open Web Cloud.
Open Domain names and select your domain.
Open the DNS zone tab, then choose Add an entry above the table.

Adding an entry is short: pick the record type, fill in the fields, then click Add. OVHcloud also lists dedicated SPF, DKIM, and DMARC entry types, but a plain TXT entry works for all of them and is the simplest path.

Step 2: Add the record

For a TXT entry you set a Sub-domain, a Value, and a TTL. The apex rule: for the root domain, leave the Sub-domain field blank. Do not type @.

DMARC

Type:       TXT
Sub-domain: _dmarc
Value:      v=DMARC1; p=none; rua=mailto:you@yourdomain.com
TTL:        By default

Start at p=none, then move past p=none once your reports are clean.

SPF

Type:       TXT
Sub-domain: (leave blank for the apex)
Value:      v=spf1 include:_spf.yourprovider.com ~all
TTL:        By default

Keep a single v=spf1 record. If OVHcloud mail already added one, edit it to include your other senders rather than creating a second record.

DKIM

Type:       TXT
Sub-domain: selector._domainkey
Value:      v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)
TTL:        By default

Paste the whole key into the Value field as one entry. OVHcloud stores it as a single record.

MTA-STS pointer

Type:       TXT
Sub-domain: _mta-sts
Value:      v=STSv1; id=20260623000000
TTL:        By default

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) is the same shape. Click Add to save.

OVHcloud quirks that bite

Leave the apex sub-domain blank. An @ in the Sub-domain field creates the wrong record.
Do not use Reset my DNS zone. That button reverts the whole zone to OVHcloud's minimal defaults and wipes your records. It is not how you edit a single entry.
OVHcloud mail manages its own records. If you use an OVHcloud email product, it adds the MX and authentication records it needs. Do not duplicate those.
One SPF record. Merge into a single v=spf1 record.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. OVHcloud says to allow up to 24 hours for a change to take full effect everywhere.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the change resolves. We read the record again from public DNS and refresh the page.

Fix DNS issues with one click. See the exact change before it goes live.

Click the fix. We email you the exact record, wait five minutes, write it to Cloudflare or AWS Route 53, and read it back from public DNS. On any other DNS host, you get the record and a link to the right page. Included on every plan.

Was this page helpful?