Setup Guide

How to Set Up SPF, DKIM, and DMARC for Postmark

Postmark is a transactional email service known for fast delivery and high deliverability. It's commonly used for password resets, receipts, notifications, and other application-generated emails. Postmark takes authentication seriously and provides straightforward setup tools.

SPF Configuration

Postmark uses the spf.mtasv.net include for SPF authorization.

DNS Record:

Type:  TXT
Host:  @
Value: v=spf1 include:spf.mtasv.net ~all

Combined with other services:

v=spf1 include:_spf.google.com include:spf.mtasv.net ~all

Verify your total lookup count with the SenderClarity SPF Checker.

DKIM Configuration

Postmark provides DKIM setup through their Sender Signatures or Domains feature.

  1. In the Postmark dashboard, go to Sender Signatures or Domains.
  2. Add your domain.
  3. Postmark will generate a DKIM TXT record:
Type:  TXT
Host:  [date]._domainkey  (e.g., 20221121._domainkey)
Value: (provided by Postmark — unique to your account)
  1. Add the TXT record to your DNS.
  2. Return to Postmark and click Verify.

Postmark uses a date-based selector format, which changes when keys are rotated. They'll notify you if a rotation is needed.

Return-Path (Custom Bounce Domain)

Postmark also supports a custom return-path domain, which helps with SPF alignment under DMARC.

Type:  CNAME
Host:  pm-bounces
Value: pm.mtasv.net

This is optional but recommended for DMARC alignment.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Postmark also provides their own free DMARC monitoring tool, but SenderClarity provides more comprehensive analysis and guidance across all your sending sources.

Progress to enforcement:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

Verification

  • Check your SPF record →
  • Use Postmark's built-in test email feature
  • Check headers for spf=pass, dkim=pass, dmarc=pass
  • Monitor DMARC reports in SenderClarity

Common Issues

Return-path alignment: Without the custom bounce CNAME, Postmark's return-path will be under mtasv.net, causing SPF alignment to fail under DMARC. DKIM alignment will still work if configured, but adding the bounce CNAME gives you both.

DKIM record too long: Postmark's DKIM records can be long. Some DNS providers have character limits on TXT records. If your provider truncates the record, contact them about support for long TXT records or splitting across multiple strings.

SPF Lookup Impact

Include Estimated Lookups
spf.mtasv.net 1

Postmark has a very lightweight SPF footprint.