SPF and DKIM by provider

SPF record for Postmark

Last updated 2026-08-29

Postmark sends transactional email over its API or SMTP. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Add one mechanism to the SPF record on your sending domain:

In a complete record, alongside Google Workspace, that looks like:

One include, one lookup, no nesting. Postmark is the cheapest entry on this page in lookup terms, which matters when you are already close to the limit.

Then count your lookups. SPF allows ten DNS-querying mechanisms across the entire nested chain, and the eleventh turns the record into a permerror that authorises nothing. The record still reads correctly to a human while every check fails. Run the domain through the SPF checker after every change, because the number moves when your providers change their own records, not just when you change yours.

DKIM

Postmark generates the key per sending domain and shows you the TXT record to publish under the pm selector by default. Add the domain under Sender Signatures, publish what it shows, then press Verify. Key rotation is a button in the same screen, and it publishes the new key alongside the old one so nothing in flight breaks.

Return path and SPF alignment

Set the custom return-path so SPF aligns as well as DKIM:

Without it, SPF authenticates Postmark's own bounce domain. DKIM still aligns, so DMARC still passes, but two aligned identifiers is a better place to be than one.

DMARC alignment with Postmark

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Postmark specifics:

• Postmark is transactional only and enforces it. Send a marketing blast through it and the account gets paused, which is a deliverability feature rather than a limitation.
• The reports this record asks for are what our weekly digest parses into one Monday email, and on a paid plan a new failing source becomes an alert the day its report arrives. Free for one domain.
• Message streams separate transactional from broadcast traffic. The DNS records are the same either way.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Postmark to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Postmark's own documentation, at Postmark support. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.