Set up SPF, DKIM and DMARC with OVHcloud, IONOS and other European hosts

What it means

Many small businesses get their email with their domain or web hosting from a host such as OVHcloud, IONOS, Hostinger, Gandi, o2switch or Infomaniak. The host runs the mail servers, but your domain still needs the right DNS records to prove these servers are allowed to send for you:

• SPF: lists the host's sending servers.
• DKIM: a signature on each email, if the host offers it.
• DMARC: your policy and reporting address.

Menus differ between hosts and change often, so this guide gives the steps that are the same everywhere.

Why it matters

• Hosts sometimes add a default SPF record, but rarely DKIM and DMARC.
• Gmail, Outlook and Yahoo send unauthenticated emails to spam more often, and Gmail and Yahoo expect DMARC from bulk senders.
• When you add a newsletter tool or move your DNS elsewhere, the host's default records are often lost or duplicated.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF, DMARC and MX records without sending anything.

How to fix it

1. Find where your DNS is managed

Your DNS may be at your host or elsewhere (Cloudflare, your registrar). The Domain scanner shows your name servers. Add records where the DNS really lives, or they will have no effect.

2. Find your host's SPF value

Search your host's help pages for "SPF". Values often look like these, but always confirm them:

• OVHcloud email offers: include:mx.ovh.com
• IONOS: an include such as include:_spf-eu.ionos.com

Then keep one SPF line, adding other tools if needed:

v=spf1 include:mx.ovh.com include:spf.newsletter-example.com ~all

If the host created an SPF record automatically and you add your own, you now have two: merge them into one.

3. Enable DKIM

Look in the email or domain section of your control panel for "DKIM". Depending on the host:

• It can be enabled with one click when your DNS is hosted there.
• It can give you records (TXT or CNAME) to copy into external DNS.
• Some basic or older offers do not support DKIM. Ask support, or move your mailbox to a provider that does.

4. Add DMARC

Add a TXT record at _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

After a few weeks of clean reports, move to quarantine, then reject.

5. Website forms and scripts

Contact forms and scripts on shared hosting may send through a different server than your mailbox. Test them too, and configure them to send through your authenticated mailbox with SMTP.

Check that it is fixed

DNS changes can take from a few minutes to 48 hours. Run the Domain scanner again: one valid SPF and one DMARC record should appear. Then send an email from your hosted mailbox and from your website form to a fresh Delivmail test address. SPF, DKIM and DMARC should pass for your domain.