IONOS SPF and DKIM setup

What you are setting up

IONOS (formerly 1&1) hosts your mailboxes, and every message your team sends from Outlook, Mail, or IONOS Webmail leaves through IONOS mail servers. To authenticate that mail you need an SPF record that lists those servers and DKIM records that let IONOS sign as your domain. Whether you have to do anything at all depends on one question: who hosts your DNS? With the IONOS name servers, IONOS publishes both for you. With any other DNS host, you publish them yourself.

Publish SPF and DKIM

If your domain uses the IONOS name servers (the default for a domain registered at IONOS), SPF is enabled for every IONOS-hosted domain and the DKIM records are created automatically. If the SPF record is ever missing, open the domain's DNS settings, click Add Record, choose IONOS SPF (TXT), and save. If a different SPF record already exists, IONOS supplements it with its own mail servers rather than replacing it.

If your DNS is hosted elsewhere (Cloudflare, Route 53, another registrar), publish these records at your DNS host:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:_spf-us.ionos.com ~all

Type:  CNAME   (DKIM)
Host:  s1-ionos._domainkey
Value: s1.dkim.ionos.com

Type:  CNAME   (DKIM)
Host:  s2-ionos._domainkey
Value: s2.dkim.ionos.com

Type:  CNAME   (DKIM)
Host:  s<number>._domainkey        (the third record IONOS lists for you)
Value: s<number>.dkim.ionos.com

The SPF include is regional: US accounts use _spf-us.ionos.com and UK and EU accounts use _spf-eu.ionos.com. Use the one shown in the IONOS help center for your country. If you already have an SPF record, merge the include into it rather than adding a second SPF record. IONOS lists three DKIM CNAME records: the two named selectors above plus a third numeric one, so copy all three exactly as shown in your account. For a subdomain, append the subdomain name to each host (s1-ionos._domainkey.mail for mail.yourdomain.com). Keep the default TTL of one hour.

Receiving mail through IONOS needs the MX records too: mx00.ionos.com and mx01.ionos.com. They do not affect authentication, but a domain with the SPF include and no MX records is a common half-migrated state.

Add DMARC

Standard _dmarc TXT record, nothing IONOS-specific. In the IONOS DNS settings, click Add Record, choose TXT, and enter _dmarc as the host name. IONOS's own example jumps straight to p=reject; start in monitor-only mode instead and ramp up once you can see your reports:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. IONOS applies the change immediately, and the rest of the world sees it within about an hour.

The IONOS gotcha

Moving your name servers silently turns DKIM off. Because IONOS publishes the DKIM records only inside its own DNS zone, the day you point the domain at Cloudflare or any other DNS host, those records vanish and IONOS keeps sending unsigned mail. Nothing in the mailbox warns you. The fix is the three CNAME records above; the symptom is IONOS showing up in your DMARC reports as SPF-only, and failing outright once mail is forwarded. The second thing that bites is the wrong region: an EU-hosted account with _spf-us.ionos.com in its record can pass or fail depending on which server handled the message, which shows up as intermittent SPF failures rather than a clean break.

Confirm it worked

• Resolve the selectors. s1-ionos._domainkey.yourdomain.com should follow its CNAME to a DKIM key. Our DKIM record checker does the lookup for you.
• Send a test and read the headers. Send from an IONOS mailbox, open the message, and confirm the DKIM signature shows d=yourdomain.com with an s1-ionos or s2-ionos selector and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. IONOS should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.