Postmark SPF, DKIM and DMARC setup

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Postmark account: copy it from Postmark's setup screen, which shows the exact record.

SPF

No SPF include is needed: Postmark says include:spf.mtasv.net is no longer required, and an include at your root does nothing for DMARC. The Return-Path is [email protected] by default; SPF aligns only after you publish the pm-bounces.{domain} CNAME to pm.mtasv.net, and only under relaxed alignment.

DKIM

One TXT record under a dated selector ({timestamp}pm._domainkey), with the host and value shown under Sender Signatures > DNS Settings. Postmark says it uses 1024-bit keys. Rotation is manual and Postmark suggests a new key at least every 3 months; each new key gets a new selector, and Postmark switches to it once its record verifies.

DMARC alignment

DKIM aligns once the domain's DKIM TXT record is verified, because Postmark then signs with your domain's key. SPF aligns only after the custom Return-Path is verified, and only under relaxed SPF alignment (aspf=r), since the Return-Path is always a subdomain.

Common mistakes

• Strict SPF alignment (aspf=s) can never pass with Postmark, because the custom Return-Path must be a subdomain.
• A CNAME can't share its name with TXT or MX records, so the Return-Path host must be a dedicated subdomain with no separate SPF record.
• Some DNS hosts append the zone, turning pm.mtasv.net into pm.mtasv.net.example.com (add a trailing dot) or doubling the DKIM host (enter only the part before your domain).
• On Cloudflare, turn proxying off (grey cloud) for the Return-Path CNAME or it may not verify.
• Rotation changes the selector: publish the new {timestamp}pm record and let it verify before Postmark switches keys, then remove the old one a few days later.
• The API's DKIMVerified stays true even if the record is later removed from DNS, so check DNS directly to catch a deleted key.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

• SPF checkerincludes, the 10-lookup limit, the all mechanism
• DKIM checkerany selector, key size, CNAME target
• DMARC checkerpolicy, reporting addresses, every tag
• Email header analyzerdid a real Postmark message pass and align?

Questions