// GUIDE

SPF, DKIM and DMARC in Plesk

Plesk ships SPF and DMARC in its DNS template, but DKIM signing has to be turned on domain by domain. If Plesk does not manage the domain’s DNS, you copy the records to your DNS provider yourself.

What to publish

SPF TXT @ (the domain)

v=spf1 +a +mx +a:<your-server> -all

The one in the Plesk template, with your server’s name. If you also send from Microsoft 365, Google or a newsletter tool, add their include: in the same record.

DKIM TXT default._domainkey

The public key Plesk generates when you turn DKIM on.

Plesk also adds _domainkey, with the policy. With external DNS, you copy both from the “How to configure external DNS” hint.

DMARC TXT _dmarc

v=DMARC1; adkim=s; aspf=s; p=quarantine

The one in the Plesk template: it already sends failing mail to spam and requires strict alignment (adkim=s; aspf=s), so a service that signs or sends with a subdomain will fail. Add rua=mailto:… to see who sends on your behalf before moving to reject.

Step by step

Websites & Domains > your domain > Mail tab > Mail Settings.
Tick “Use DKIM spam protection system to sign outgoing email messages” and press Apply.
If Plesk manages the DNS, you are done: it adds the records. If the DNS is elsewhere (Cloudflare, your registrar…), open “How to configure external DNS” on that same screen and copy both records to your DNS provider.
Check SPF and DMARC under Websites & Domains > your domain > DNS Settings (or in your external DNS): add other services’ include: and the rua address.

Usual mistakes

Turning DKIM on with DNS outside Plesk and not copying the records: Plesk signs, but nobody can verify the signature.
Having the domain on Cloudflare and editing the Plesk zone: those changes do nothing, Cloudflare’s zone is the one that counts.
Sending from Microsoft 365 or Google with the template SPF, without their include:.
Not turning DKIM on for the server: website mail (forms, notifications) goes out unsigned and, with p=quarantine, ends up in spam.

Towards p=reject

DMARC at p=none only watches. The reports (rua) show who sends on your behalf; once all your legitimate mail passes aligned SPF or DKIM, move to quarantine and then to reject. That way, nobody can use your domain to send forged mail.

Check your domain

Sources

Checked on 24 September 2026. Panels change: if something does not match, the provider’s documentation wins.