Postmark email authentication: SPF, DKIM and DMARC
Postmark needs two records for a domain: a DKIM TXT record and a Return-Path CNAME. The CNAME is what makes SPF pass and align, so unlike most senders you do not add Postmark to your own SPF record.
Record values checked against Postmark’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Postmark
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
SPF for Postmark
Nothing to add to your own SPF record for Postmark in the standard setup. The notes below explain why, and what to do if your setup differs.
- Postmark states it is no longer required to include Postmark in your own custom SPF record.
- Postmark shows an optional include:spf.mtasv.net example, but warns it does nothing for you: the Return-Path domain is what receivers use to check SPF alignment, not your root SPF record.
- Postmark says mail sent through it passes SPF by default because the Return-Path already includes its sending IPs. Adding the optional include would cost 1 DNS lookup on the verification date, for no gain.
DKIM for Postmark
Where: Postmark: Sender Signatures > add or open your domain > DNS Settings link
- In Postmark select Sender Signatures, add your domain if needed, then click the DNS Settings link next to it. The DKIM section is there.
- Copy the TXT record: the host is a generated selector ending in pm followed by ._domainkey, the value starts v=DKIM1; k=rsa; p=.
- Publish it at your DNS host. Postmark checks DNS periodically and verifies the record automatically.
| Type | Name | Value |
|---|---|---|
| TXT | <generated selector>pm._domainkey | v=DKIM1; k=rsa; p=<public key from Postmark>Postmark describes the host as a generated name that usually follows a format like 2023060112345pm._domainkey. Copy the exact host and value from DNS Settings. |
Selector. The selector is generated per signature and ends in pm, so there is no fixed name to look up. Enter the one from Postmark DNS Settings in the DKIM checker.
- If you use Cloudflare, set CNAME records used for authentication, including the Return-Path, to DNS only (grey cloud), not proxied.
DMARC with Postmark
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- A custom Return-Path that aligns with your domain achieves SPF alignment, and DKIM under your own domain gives the second alignment path. With both in place DMARC has two ways to pass.
- The default Return-Path host is pm-bounces. With a Return-Path of pm-bounces.example.com and a From of example.com, the domains are aligned.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Custom Return-Path
Without it, SPF passes on Postmark’s own domain but does not align with yours. Create the CNAME in DNS pointing at Postmark so it can still collect bounces and other feedback.
| Type | Name | Value |
|---|---|---|
| CNAME | pm-bounces | pm.mtasv.netpm-bounces is the default hostname. You cannot also put a TXT record on the same name as the CNAME. |
Common Postmark mistakes
- Adding include:spf.mtasv.net to the root SPF record and assuming SPF is now aligned. It is not: alignment comes from the Return-Path.
- Skipping the Return-Path CNAME. SPF then passes but does not align with your From domain.
- Proxying the Return-Path CNAME through Cloudflare. Keep it on DNS only.
- Copying a DKIM host from a tutorial instead of from DNS Settings. The selector is generated.
- Putting a TXT record on the Return-Path name. A CNAME and a TXT cannot share a name.
Postmark email authentication FAQ
Does Postmark need an SPF include?
No. Postmark says it is no longer required to include it in your own SPF record. The Return-Path CNAME gives SPF pass and alignment.
What is the Postmark Return-Path CNAME?
A CNAME on a subdomain of your domain, pm-bounces by default, pointing to pm.mtasv.net. It lets Postmark collect bounces and gives SPF alignment with your From domain.
Where do I find the Postmark DKIM record?
Under Sender Signatures: click the DNS Settings link next to your domain. The host ends in pm._domainkey and the value is a v=DKIM1 TXT record.
How long does Postmark take to verify DNS?
Postmark checks DNS periodically and verifies automatically. It can take up to 48 hours but usually completes in a few minutes.
Can I have SPF records for both Postmark and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Postmark authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.