Set up SPF, DKIM, and DMARC on Porkbun
Add SPF, DKIM, and DMARC as TXT records in Porkbun's "Manage DNS Records" editor, leaving the Host field blank (not "@") for root-level records like SPF.
Where to add records on Porkbun
Log in at porkbun.com — you land on the Domain Management page (also reachable via the Account menu, top-right). Find your domain and click the "DNS" button beneath/next to it (or click "Details", then the edit/pencil icon under the "DNS RECORDS" heading). This opens the "Manage DNS Records" page; the add-record form ("Add Record") sits at the top, with your existing records listed below.
- Log in at porkbun.com; you arrive on the Domain Management page (or open it from the Account menu, top-right).
- Find the domain and click its DNS button to open Manage DNS Records (or Details, then the edit icon under DNS RECORDS).
- In the Add Record form, set Type to TXT from the dropdown.
- Fill in Host: leave it completely BLANK for a root record (SPF) or type just the subdomain label (e.g. _dmarc for DMARC, or the selector your email provider gives you for DKIM) — do not append the domain name.
- Paste the record content into the Answer field exactly as given (no surrounding quotes), and leave TTL at the default 600 (the minimum Porkbun allows).
- Click Add to save, then repeat for each record. Confirm with dnschecker.org or `dig TXT` once it propagates (usually ~15 minutes).
The three records on Porkbun
SPF Sender Policy Framework
SPF is a root-domain TXT record, so leave the Host field BLANK — Porkbun's own docs say to leave Host empty for the root/apex domain; it does NOT use "@", and typing @ stores a literal "@" label instead of the apex. Put the full policy, e.g. `v=spf1 include:_spf.google.com ~all`, in the Answer field. Publish only ONE SPF TXT record on the root — merge all senders into a single `v=spf1 ...` string; two SPF records is a permerror.
DKIM DomainKeys Identified Mail
Porkbun only generates DKIM for you if you use Porkbun's own email hosting — in that case the "Configure DMARC" button (visible only when an email-hosting plan is active on the domain) auto-creates the DKIM (default._domainkey) and DMARC TXT records for you. That auto-config requires the domain to be on Porkbun's default nameservers; on third-party nameservers you'll see a DMARC Warning instead and must add the records by hand. For external email (Google Workspace, Microsoft 365, etc.), get the DKIM key/selector from that provider and add it here as a TXT record: in Host put only the selector portion before your domain (e.g. `google._domainkey` or `selector1._domainkey`), and paste the long `v=DKIM1; k=rsa; p=...` value into Answer. Paste the whole key as one string — Porkbun accepts it without manual splitting and without quotes.
DMARC reporting and policy
Add a TXT record with Host set to exactly `_dmarc` (just that label — Porkbun appends your domain automatically; do not enter `_dmarc.example.com`). Put your policy in the Answer field, e.g. `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` to start in monitoring mode, then tighten to `p=quarantine` / `p=reject` later. Only one _dmarc record per domain.
Need the record values? Generate a valid SPF and DMARC record with the record generator, then learn what each one does: SPF, DKIM, DMARC.
Porkbun gotchas
- Root/apex records use a BLANK Host field, not "@". This is Porkbun's biggest quirk versus most registrars — and it's stated in Porkbun's own KB: for the root domain, leave Host empty. Entering @ creates a record for the literal "@" label instead of the apex.
- Do NOT wrap values in quotes. Porkbun stores the raw Answer string and handles quoting internally; adding your own double-quotes bakes literal quote characters into the published TXT record and breaks SPF/DKIM/DMARC parsing.
- Long SPF/DKIM strings: paste the entire value into one Answer field. Porkbun does not require you to manually split strings into 255-char chunks — enter it whole.
- TTL minimum is 600 seconds (10 minutes), which is also the default; you can't go lower. New records usually resolve within ~15 minutes (occasionally a few hours), but edits to an EXISTING record can be cached for up to its old TTL. Use dnschecker.org to confirm.
- Subdomain labels (_dmarc, selector._domainkey) go in Host as just the label — never append the domain. Porkbun adds the apex for you, so typing the full FQDN produces a doubled name like _dmarc.example.com.example.com.
- The automatic DKIM/DMARC "Configure DMARC" button only appears if the domain has a Porkbun email-hosting plan AND is on Porkbun's default nameservers — on external nameservers you must add DKIM/DMARC TXT records manually.
Records set. Now make sure you actually land.
SPF, DKIM, and DMARC on Porkbun get you authenticated, but inbox placement also needs sender reputation and domain warmup. Scheduler Zero handles both so your cold email reaches the inbox.