Setup Guide

How to Set Up SPF, DKIM, and DMARC for Postmark

Postmark is a transactional email service known for fast delivery and high deliverability. It's commonly used for password resets, receipts, notifications, and other application-generated emails. Postmark takes authentication seriously and provides straightforward setup tools.

SPF Configuration

Postmark uses the spf.mtasv.net include for SPF authorization.

DNS Record:

Type:  TXT
Host:  @
Value: v=spf1 include:spf.mtasv.net ~all

Combined with other services:

v=spf1 include:_spf.google.com include:spf.mtasv.net ~all

Verify your total lookup count with the SenderClarity SPF Checker.

DKIM Configuration

Postmark provides DKIM setup through their Sender Signatures or Domains feature.

  1. In the Postmark dashboard, go to Sender Signatures or Domains.
  2. Add your domain.
  3. Postmark will generate a DKIM TXT record:
Type:  TXT
Host:  [date]._domainkey  (e.g., 20221121._domainkey)
Value: (provided by Postmark — unique to your account)
  1. Add the TXT record to your DNS.
  2. Return to Postmark and click Verify.

Postmark uses a date-based selector format, which changes when keys are rotated. They'll notify you if a rotation is needed.

Return-Path (Custom Bounce Domain)

Postmark also supports a custom return-path domain, which helps with SPF alignment under DMARC.

Type:  CNAME
Host:  pm-bounces
Value: pm.mtasv.net

This is optional but recommended for DMARC alignment.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Postmark also provides their own free DMARC monitoring tool, but SenderClarity provides more comprehensive analysis and guidance across all your sending sources.

Progress to enforcement:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

DMARC Considerations for Postmark

  • Custom bounce domain unlocks dual alignment: Postmark is one of the few transactional email providers that makes it easy to achieve both SPF and DKIM alignment. The optional pm-bounces CNAME sets up a custom return-path under your domain. With this in place, both authentication mechanisms align — a strong foundation for aggressive DMARC enforcement.

  • Postmark's strict sending policies work in your favor: Postmark prohibits bulk marketing email and maintains tight abuse controls. This means their IP reputation is consistently high, and you're unlikely to see deliverability issues caused by other senders on their infrastructure. For DMARC enforcement, this translates to reliable, predictable authentication results in your reports.

  • Date-based DKIM selectors require attention during rotation: Postmark uses selectors like 20221121._domainkey that include the generation date. When Postmark rotates keys, you'll need to add a new DNS record with the updated selector. Unlike providers that use CNAME-based DKIM (where rotation is transparent), Postmark key rotations require a DNS change on your end.

Verification

  • Check your SPF record →
  • Use Postmark's built-in test email feature
  • Check headers for spf=pass, dkim=pass, dmarc=pass
  • Monitor DMARC reports in SenderClarity

Common Issues

Return-path alignment: Without the custom bounce CNAME, Postmark's return-path will be under mtasv.net, causing SPF alignment to fail under DMARC. DKIM alignment will still work if configured, but adding the bounce CNAME gives you both.

DKIM record too long: Postmark's DKIM records can be long. Some DNS providers have character limits on TXT records. If your provider truncates the record, contact them about support for long TXT records or splitting across multiple strings.

SPF Lookup Impact

Include Estimated Lookups
spf.mtasv.net 1

Postmark has a very lightweight SPF footprint.