// GUIDE

SPF, DKIM and DMARC in IONOS

If your domain uses IONOS name servers, the SPF and DKIM for its mail come already set up. If the DNS is elsewhere (for example, on Cloudflare), you copy those records yourself. You add DMARC either way.

What to publish

SPF TXT @ (the domain)

v=spf1 include:_spf-eu.ionos.com ~all

For European accounts (IONOS Spain, Germany…); in the United States, include:_spf-us.ionos.com. With IONOS name servers it is added automatically (“IONOS SPF”).

DKIM CNAME s1-ionos._domainkey

s1.dkim.ionos.com

Only if your DNS is outside IONOS; with its name servers it is already there.

DKIM CNAME s2-ionos._domainkey

s2.dkim.ionos.com

Same. If IONOS help or the panel show you another DKIM record, copy it as it is too.

DMARC TXT _dmarc

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start at p=none with reports and move to quarantine and reject once all your legitimate mail passes (below).

Step by step

In the IONOS panel, open the domain’s DNS settings.
With IONOS name servers, check that the “IONOS SPF” (TXT) record is there and that there is no other SPF record: if you send from more services, their include: go in that same record.
With DNS outside IONOS, create the SPF record and the DKIM CNAMEs from the table at your DNS provider (TTL of one hour).
Add the DMARC record (type TXT, name _dmarc) and read the reports for a few weeks before raising the policy.

Usual mistakes

Using the US include on a European account (or the other way round): it does not cover the servers that send your mail.
Moving the DNS to Cloudflare and forgetting to copy the IONOS DKIM CNAMEs.
Worrying because _spf-eu.ionos.com ends in ?all: inside an include: that does not weaken your SPF, your own record’s all decides.

Towards p=reject

DMARC at p=none only watches. The reports (rua) show who sends on your behalf; once all your legitimate mail passes aligned SPF or DKIM, move to quarantine and then to reject. That way, nobody can use your domain to send forged mail.

Check your domain

Sources

Checked on 24 September 2026. Panels change: if something does not match, the provider’s documentation wins.