SPF record for Postmark

Postmark sends transactional email over its API or SMTP. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

You don't need include:spf.mtasv.net in your root SPF record. Postmark's SPF article says it's no longer required, and I checked it on 23 Oct 2026. Receivers check SPF on the return-path domain, which is Postmark's own bounce domain or the pm-bounces subdomain below. Receivers never check SPF on your root domain for Postmark mail, so the include in your root record does nothing for DMARC.

If it's already in your record, it costs one of your ten lookups. Remove it when you're close to the limit.

The include is:

Count your lookups after any change, because SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count. It also shows whether Postmark needs the include on the domain you check.

DKIM

Postmark generates the key per sending domain and shows you the TXT record to publish. The selector starts with a date and ends in pm, as in 20230601123456pm._domainkey, so copy the name from Postmark's screen. Add the domain under Sender Signatures, publish what it shows, then press Verify. Key rotation is a button in the same screen, and Postmark publishes the new key alongside the old one so nothing in flight breaks.

Return path and SPF alignment

Set the custom return-path so SPF aligns as well as DKIM:

Without it, SPF authenticates Postmark's own bounce domain. DKIM still aligns, so DMARC still passes. With both aligned, your mail keeps passing DMARC if one of them breaks.

DMARC alignment with Postmark

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Our weekly digest reads the DMARC reports receivers send you and sums them up in one Monday email. On a paid plan, we alert you the day a report shows a new failing source. The free plan covers one domain.
• Message streams separate transactional from broadcast traffic. The DNS records are the same either way.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Postmark to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Postmark's own documentation, at Postmark support. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.