Set up SPF, DKIM, and DMARC on IONOS
Add SPF, DKIM, and DMARC at IONOS as TXT records under Domains & SSL → your domain → DNS → Add Record, using @ in the Host name field for the root domain and _dmarc for DMARC.
Where to add records on IONOS
Log in to the IONOS Control Panel (also called the Control Center). Open the "Domains & SSL" area — either via the pop-up menu in the upper-left corner, the "Domains & SSL" tab, or the "Manage domain" button. Click the domain you want (or click the gear icon under the "Actions" column for that domain) and choose "DNS". This opens the DNS records list for that domain, where SPF, DKIM, and DMARC TXT records are added.
- In the Control Panel, open Domains & SSL, click the target domain (or the gear icon under Actions) and choose DNS to open the records list.
- Click the 'Add Record' (shown as ADD RECORD) button.
- Under 'Type', select 'TXT'. (For IONOS's own SPF you can instead pick the dedicated 'IONOS SPF (TXT)' shortcut, which auto-fills the value.)
- In the 'Host name' field, enter '@' for the root domain; for DMARC enter '_dmarc'; for an external-provider DKIM key enter the selector exactly, e.g. 'google._domainkey'. Do NOT type the full domain name — IONOS appends it automatically.
- In the 'Value' field, paste the record contents (the v=spf1… / v=DMARC1… / DKIM key string) without surrounding quotes.
- Optionally adjust 'TTL' (defaults to 1 hour), then click 'Save'. Changes apply immediately at IONOS but can take up to ~1 hour to propagate globally.
The three records on IONOS
SPF Sender Policy Framework
Choose Type = TXT and enter '@' in the Host name field for the root domain (this is the value IONOS uses in its own examples), then put the policy in Value, e.g. 'v=spf1 include:_spf-us.ionos.com ~all' for IONOS mail. IONOS also offers a one-click 'IONOS SPF (TXT)' record type that auto-inserts the correct IONOS includes. Only ONE SPF (TXT) record may exist per domain — merge all senders into a single 'v=spf1 …' string instead of adding a second record, or SPF authentication breaks.
DKIM DomainKeys Identified Mail
If you use IONOS name servers (the default) for a domain whose mail is hosted at IONOS, DKIM is set up automatically — IONOS creates the required records for you, nothing to add. If your mail is at IONOS but the DNS zone is managed by ANOTHER provider, IONOS has you add THREE CNAME records: 's1-ionos._domainkey' → 's1.dkim.ionos.com', 's2-ionos._domainkey' → 's2.dkim.ionos.com', and a numeric selector like 's42582890._domainkey' → 's42582890.dkim.ionos.com'. For DKIM with an EXTERNAL mail provider (Google Workspace, Microsoft 365, an ESP), generate the key in that provider first, then at IONOS click Add Record and add exactly what it gives you — usually a TXT record with Host name set to the selector (e.g. 'google._domainkey' or 'selector1._domainkey') and the long 'v=DKIM1; k=rsa; p=…' string in Value, though some providers use CNAME records instead. Add the exact record type the provider specifies.
DMARC reporting and policy
Click Add Record, set Type = TXT, set Host name to '_dmarc' (just that, not the full domain — IONOS appends your domain automatically to create '_dmarc.your-domain.com'), and put the policy in Value, e.g. 'v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com'. Separate the individual tags with semicolons. Save; the record is live at IONOS immediately and propagates within about an hour.
Need the record values? Generate a valid SPF and DMARC record with the record generator, then learn what each one does: SPF, DKIM, DMARC.
IONOS gotchas
- Root/apex = '@' in Host name. IONOS's own examples use '@' for the root domain (SPF/DMARC at the apex). Do NOT type the full domain — IONOS auto-appends it, so entering 'yourdomain.com' becomes 'yourdomain.com.yourdomain.com'. For DMARC the Host name is just '_dmarc', not '_dmarc.yourdomain.com'.
- Only one SPF record allowed. IONOS (like the spec) permits a single 'v=spf1' TXT at the root; if you manually add a second SPF record, SPF will fail — combine all 'include:' mechanisms into one string. The one-click 'IONOS SPF (TXT)' option handles the IONOS includes for you.
- Don't wrap values in quotes. Enter the raw value (v=spf1…, v=DMARC1…, v=DKIM1…); IONOS stores it and handles any quoting itself. Pasting your own surrounding double-quotes can produce a malformed record.
- Propagation: changes are effective at IONOS instantly, but global DNS propagation can take up to ~1 hour (occasionally longer) — verify with an external checker before assuming a record is wrong. Default TTL is 1 hour.
Records set. Now make sure you actually land.
SPF, DKIM, and DMARC on IONOS get you authenticated, but inbox placement also needs sender reputation and domain warmup. Scheduler Zero handles both so your cold email reaches the inbox.