Setup guide
Postmark: SPF, DKIM and DMARC
Postmark needs a DKIM TXT record with a date-based selector and a Return-Path CNAME. No change to your root SPF record is needed.
By Ahmet Karaca · Updated · Checked against Postmark documentation on
DNS records to add
<date>pm._domainkey<DKIM value from Postmark → Sender Signatures → DNS Settings>Get this value from your provider's dashboard.DKIM signing key
pm-bouncespm.mtasv.netCustom Return-Path so SPF aligns
Steps
- In Postmark open Sender Signatures → your domain → DNS Settings.
- Publish the DKIM TXT record exactly as shown; the selector contains a timestamp.
- Publish the pm-bounces CNAME and click Verify for both records.
Common mistakes
- Without the custom Return-Path, bounces go to pm.mtasv.net, so SPF alignment fails and DMARC can pass only through DKIM.
- Renaming pm-bounces in DNS without changing it in Postmark, or the other way round, keeps the Return-Path unverified. The hostname must match in both places.
- If your DNS host appends your domain to the CNAME value, the Return-Path won't verify. Postmark suggests entering pm.mtasv.net. with a trailing dot.
- Deleting the old DKIM TXT record as soon as a rotated key verifies can fail messages still in transit. Postmark suggests waiting a few days before removing it.
Good to know
- Our DKIM check can't guess Postmark's selector. Enter it (for example 20240212123456pm) to check the key.
Frequently asked questions
How long until Postmark shows DKIM as verified?
Within 48 hours of adding the record to your DNS.
How often should I rotate my Postmark DKIM key?
At least once every 3 months. Click Generate New under the DKIM key in DNS Settings, publish the new TXT record and click Verify; Postmark then revokes the old key.
Can I use a hostname other than pm-bounces?
Yes. Any name works as long as the CNAME points to pm.mtasv.net and the same name is entered in Postmark.
Will Postmark's records affect my other DNS records?
No. Postmark states that adding the DKIM and Return-Path records doesn't affect any DNS records already in place.
Can I send from any address once the domain is verified in Postmark?
Yes. Domain verification lets you send from any address at that domain without verifying each sender.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Postmark documentation.
Check your Postmark setup
Or open the SPF checker, DKIM checker or DMARC checker directly.