Adding DMARC, SPF, and DKIM records in OVHcloud

Before you start: confirm OVHcloud answers your DNS

OVHcloud assigns each domain a pair of nameservers in the ovh.net family, of the matched form dnsNN.ovh.net and nsNN.ovh.net (the NN is a number with no special meaning). Confirm:

dig +short NS yourdomain.com

If the answers end in ovh.net, the OVHcloud DNS zone is the right place. If you have pointed the domain at external nameservers, edit your records there instead.

Step 1: Open the DNS zone

1. Sign in to the OVHcloud Control Panel and open Web Cloud.
2. Open DNS zones and select your domain.
3. Open the DNS zone tab, then choose Add an entry.

Adding an entry is a short three-step wizard: pick the record type, fill in the values, then Confirm. OVHcloud also has dedicated SPF, DKIM, and DMARC forms, but a plain TXT entry works for all of them and is the simplest path.

Step 2: Add the record

For a TXT entry you set a Sub-domain, a Value, and a TTL. The apex rule: for the root domain, leave the Sub-domain field blank. Do not type @.

DMARC

Type:       TXT
Sub-domain: _dmarc
Value:      v=DMARC1; p=none; rua=mailto:you@yourdomain.com
TTL:        Default (3600)

Start at p=none, then move past p=none once your reports are clean.

SPF

Type:       TXT
Sub-domain: (leave blank for the apex)
Value:      v=spf1 include:_spf.yourprovider.com ~all
TTL:        Default (3600)

Keep a single v=spf1 record. If OVHcloud mail already added one, edit it to include your other senders rather than creating a second record.

DKIM

Type:       TXT
Sub-domain: selector._domainkey
Value:      v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)
TTL:        Default (3600)

Paste the whole key into the Value field as one entry. OVHcloud stores it as a single record.

MTA-STS pointer

Type:       TXT
Sub-domain: _mta-sts
Value:      v=STSv1; id=20260623000000
TTL:        Default (3600)

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com, which trustyourinbox can host. TLS-RPT (_smtp._tls) is the same shape. Step through to Confirm to save.

OVHcloud quirks that bite

• Leave the apex sub-domain blank. An @ in the Sub-domain field creates the wrong record.
• Do not use Reset my DNS zone.That button reverts the whole zone to OVHcloud's minimal defaults and wipes your records. It is not how you edit a single entry.
• OVHcloud mail manages its own records. If you use an OVHcloud email product, it handles MX (and DKIM by CNAME for Exchange). Do not duplicate those.
• One SPF record. Merge into a single v=spf1 record.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. OVHcloud applies the change on Confirm; it can take up to a few hours to appear everywhere.

Tell trustyourinbox to recheck

Each per-domain protocol tab has a Recheck button next to the current record. Click it once the change resolves and we re-run the lookup and refresh the dashboard.