Adding DMARC, SPF, and DKIM records in Porkbun

Before you start: confirm Porkbun answers your DNS

Porkbun's four default nameservers are named after Brazilian cities: curitiba, fortaleza, maceio, and salvador, each at .ns.porkbun.com. Confirm your domain uses them:

dig +short NS yourdomain.com

If the answers end in ns.porkbun.com, the Porkbun editor is the right place.

Step 1: Open Manage DNS Records

1. Sign in and open Domain Management.
2. Click the DNS button under the domain name (or open Details and edit the DNS Records section). This opens Manage DNS Records.
3. Delete the default parking records first. A fresh Porkbun domain ships with records pointing to pixie.porkbun.com that drive the parking page. Remove those (the trash-can icon) so they do not conflict with what you add.

Step 2: Add the record

Select Add Record, set Type to TXT, enter the Host, and paste the value into the field labeled Answer. For the root domain, leave Host blank; for everything else, enter just the prefix.

DMARC

Type:   TXT
Host:   _dmarc
Answer: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
TTL:    600

Start at p=none, then move past p=none once your reports are clean.

SPF

Type:   TXT
Host:   (leave blank for the apex)
Answer: v=spf1 include:_spf.yourprovider.com ~all
TTL:    600

Keep a single v=spf1 record. If you use Porkbun's free email forwarding, it adds its own SPF (include:_spf.porkbun.com); merge your sender into that one record rather than adding a second.

DKIM

Type:   TXT
Host:   selector._domainkey
Answer: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)
TTL:    600

Paste the whole key into Answer as one entry. Porkbun takes the full value without splitting.

MTA-STS pointer

Type:   TXT
Host:   _mta-sts
Answer: v=STSv1; id=20260623000000
TTL:    600

Pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) is the same shape. Porkbun's minimum TTL is 600 seconds (ten minutes), and the default is fine.

Porkbun quirks that bite

• The pixie.porkbun.com parking records. Leave them in place and you can hit a “record with that host already exists” error or unexpected behavior. Delete them when setting up real DNS.
• Blank, not @. For the apex, leave Host empty.
• Free forwarding adds an SPF. If you turned on Porkbun email forwarding, reconcile your SPF with the one it added rather than publishing a second.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. The record is live the moment the lookup returns it.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the change resolves. We read the record again from public DNS and refresh the page.