# How do you add email DNS records in IONOS?

URL: https://iblockspam.com/blog/add-email-dns-records-ionos
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Setup guides
Author: iBlockSpam Team

> How to add MX, SPF, DKIM and DMARC records in IONOS DNS: the Domains & SSL path, Host name rules, service conflicts, IONOS SPF and DKIM defaults, and checks.

## Short answer

In IONOS, open Domains & SSL, select the gear icon under Actions next to your domain and choose DNS, then Add Record. Pick MX, TXT or CNAME, enter @ or a prefix such as _dmarc as the Host name, add the value (and priority for MX), and save. Deactivate any IONOS mail service whose MX records conflict.

IONOS often comes bundled with email, so many domains there already have IONOS mail records, an IONOS SPF record and three IONOS DKIM records. When you add a different email provider, the job is less about typing new records and more about clearing the IONOS ones out of the way, which is what IONOS's "active service" conflict warnings are about.

This guide covers adding MX, SPF, DKIM and DMARC records in IONOS, using IONOS's own help pages for each step. Menu names are correct at the time of writing (October 2026). If you need a refresher on the records themselves, read [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc).

## Does your domain use IONOS nameservers?

IONOS DNS records only reach the internet when the domain uses IONOS nameservers. If you've set your own nameservers, IONOS says "you must make the DNS records with the relevant provider or in the relevant external name server" ([IONOS](https://www.ionos.com/help/domains/using-your-own-name-servers/using-your-own-name-servers-for-a-domain/)). Our [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows your live nameservers. If they belong to Cloudflare, use our [Cloudflare guide](https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare).

## Where do you add DNS records in IONOS?

All record types start from the same page ([IONOS](https://www.ionos.com/help/domains/configuring-txt-and-srv-records/managing-txt-records/)):

1. Log in to IONOS and open the **Domains & SSL** section.
2. Next to your domain, select the **gear** icon under **Actions** and choose **DNS**.
3. Select **Add Record** and choose the type.
4. Fill in the fields and save.

To change or remove a record, select the gear icon under **Actions** on that record's row and choose **Edit record** or **Delete record**.

| Field | Used for | What to enter |
|---|---|---|
| **Host name** | All types | `@` for the root domain, or only the prefix, such as `_dmarc`. IONOS adds your domain |
| **Value** | TXT | The SPF, DKIM or DMARC text |
| **Points to** | MX and CNAME | The mail server or target hostname, without http:// |
| **Priority** | MX | IONOS: "The mail server with the smallest priority code is given highest priority" |
| **TTL** | All types, optional | IONOS uses one hour |

IONOS confirms that the domain is appended for you: entering `_dmarc` means "The subdomain _dmarc.your-domain.com will be automatically created for your TXT record" ([IONOS](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/configuring-a-dmarc-record-for-a-domain/)). So never type the full domain in Host name.

## What are IONOS services and DNS conflicts?

IONOS groups records that belong to one of its products, such as IONOS mail, into a **service**. The **Service** column on the DNS page shows which records are managed that way ([IONOS](https://www.ionos.com/help/domains/general-information-about-dns-settings/managing-dns-services/)). IONOS warns you when a new record clashes with a service ([IONOS](https://www.ionos.com/help/domains/general-information-about-dns-settings/avoiding-dns-conflicts/)):

| Conflict rule (IONOS) | What it means for email |
|---|---|
| "MX records for an active service conflict with all other MX records for the same host or subdomain." | You can't mix IONOS mail MX with Google Workspace or Microsoft 365 MX. Deactivate the IONOS mail service first |
| "A CNAME record conflicts with a TXT, MX, AAAA, A, or existing CNAME record." | A DKIM CNAME can't share its name with an old DKIM TXT record. Delete the old one first |

To clear an IONOS mail service, select the gear icon under **Actions** next to that service in the DNS settings, choose **Disable service** and confirm ([IONOS](https://www.ionos.com/help/domains/general-information-about-dns-settings/managing-dns-services/)). Then add your new records. IONOS's MX article says the same: "Check whether an MX record already exists. If the MX record belongs to a service, it must be deactivated."

## What email records does IONOS add by default?

| Record | IONOS default | Source |
|---|---|---|
| MX | `mx00.ionos.com` and `mx01.ionos.com` (IONOS also lists `mx00.1and1.com` and `mx01.1and1.com` as alternatives) | [IONOS](https://www.ionos.com/help/email/troubleshooting-mail-basic-mail-business/adjusting-mx-records-for-receiving-email-via-ionos-mail-servers/) |
| SPF | "IONOS SPF is enabled by default for all IONOS-hosted domains" | [IONOS](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/using-ionos-spf-to-improve-email-delivery/) |
| DKIM | Three CNAMEs: `s1-ionos._domainkey`, `s2-ionos._domainkey` and a numbered selector, pointing to `*.dkim.ionos.com` | [IONOS](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/email-authentication-with-dkim/) |

When you move mail to another provider, the MX records go, the SPF record is edited, and the DKIM CNAMEs can stay or go depending on whether you still send from [IONOS mailboxes](https://iblockspam.com/dkim/ionos).

## How do you add or edit the SPF record in IONOS?

SPF is a TXT record on `@` that lists the servers allowed to send as your domain. IONOS says "You can only set one SPF record for a domain," and that multiple records "may cause problems with transmitting emails and properly classifying spam" ([IONOS](https://www.ionos.com/help/domains/connecting-a-domain-with-microsoft-365-from-a-third-party/setting-the-spf-record-for-microsoft-365-in-the-domain-center/)). [RFC 7208, section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2) says the same.

Because IONOS SPF "is automatically supplemented with the information of the IONOS mail servers," check for it first:

1. On the DNS page, look for a TXT record on `@` starting with `v=spf1`.
2. If it exists, select the gear icon, choose **Edit record**, and change the value so it lists every service you send from.
3. If it doesn't, select **Add Record**, choose **TXT**, enter `@` as **Host name** and the record as **Value**, then save.

Example for a domain moving to Microsoft 365 that no longer sends from IONOS (example value): `v=spf1 include:spf.protection.outlook.com -all`. If you still send through [IONOS mail](https://iblockspam.com/spf/ionos), keep its include; IONOS gives `include:_spf-us.ionos.com` for US accounts using external DNS. Our [SPF provider pages](https://iblockspam.com/spf) list other providers' includes, and the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) builds a merged record.

## How do you add a DKIM record in IONOS?

DKIM publishes the public key receivers use to verify your mail's signature. Your provider gives you a TXT record or CNAME records.

### DKIM as a CNAME (Microsoft 365 and most platforms)

IONOS's own [Microsoft 365 DKIM article](https://www.ionos.com/help/office/setting-up-microsoft-365/microsoft-365-creating-a-dkim-entry-for-a-domain-in-the-microsoft-365-defender-portal/) gives the steps:

1. Select **Add Record** and choose **CNAME**.
2. Enter the host, such as `selector1._domainkey`, as **Hostname**.
3. Paste the target into **Points to**, "the fully qualified host name ... without the http:// or https:// part."
4. Set TTL to 1 hour and save. Repeat for `selector2._domainkey`.

If Microsoft says "CNAME record does not exist," IONOS lists two causes: the change hasn't synced yet, or a copy-paste error such as "extra spaces or tabs."

### DKIM as a TXT record (Google Workspace and mail servers)

1. Select **Add Record** and choose **TXT**.
2. Enter the selector host, such as `google._domainkey`, as **Host name**.
3. Paste the key starting `v=DKIM1;` as **Value**, with no line breaks.
4. Save.

IONOS's help doesn't say how it handles TXT values longer than 255 characters, so check a 2048-bit key with a lookup after saving; our [2048-bit DKIM key guide](https://iblockspam.com/blog/dkim-2048-bit-key-txt-record-too-long) explains what a truncated key looks like. Then turn on signing, as shown in [DKIM setup for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace).

## How do you add a DMARC record in IONOS?

DMARC is a TXT record at `_dmarc` that tells receivers what to do with mail that fails authentication. IONOS has no special form; it's an ordinary TXT record ([IONOS](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/configuring-a-dmarc-record-for-a-domain/)):

1. Select **Add Record** and choose **TXT**.
2. Enter `_dmarc` as **Host name**.
3. Enter your tags separated by semicolons as **Value**, for example `v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com`.
4. Save.

IONOS's own example is `v=DMARC1;p=reject`. Don't start there unless every sender already passes; begin at `p=none` and follow our [none-to-reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business). The [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record.

## How do you change MX records in IONOS?

From IONOS's [MX article](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/using-a-domain-with-another-providers-mail-servers-editing-mx-records/):

1. Note the current MX records so you can roll back.
2. If the MX records belong to an IONOS service, deactivate that service.
3. Select **Add Record** and choose **MX**.
4. Enter `@` as **Host name**.
5. Enter the mail server in **Points to** and a **Priority**, "for example 10 or 20."
6. Save, and repeat for each MX host.

Example for Google Workspace (example values): Host name `@`, Points to `smtp.google.com`, Priority `1`. For Microsoft 365, use the MX value shown in the Microsoft 365 admin center for your domain. Changing MX moves all incoming mail at once; read [how to change MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email) first.

## How long do IONOS changes take, and how do you check them?

IONOS says it "uses a time to live of one hour for all DNS settings" and that "changes to DNS settings are usually available everywhere within an hour," with up to 72 hours in exceptional cases ([IONOS](https://www.ionos.com/help/domains/general-information-about-dns-settings/time-required-for-dns-changes/)). Then check:

| Record | Check with | Pass looks like |
|---|---|---|
| MX | [MX Lookup](https://iblockspam.com/tools/mx-lookup) | Only the new provider's hosts |
| SPF | [SPF Checker](https://iblockspam.com/tools/spf-checker) | One record, 10 lookups or fewer |
| DKIM | [DKIM Checker](https://iblockspam.com/tools/dkim-checker) | A complete key at each selector |
| DMARC | [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) | One valid record |

Send a test message to an outside mailbox and confirm `spf=pass`, `dkim=pass` and `dmarc=pass` in the headers, using our [header guide](https://iblockspam.com/blog/how-to-read-email-headers).

## What are the common IONOS email DNS mistakes?

- **Ignoring the conflict warning** and leaving the IONOS mail service active.
- **A second SPF record** next to the IONOS default.
- **Typing the full domain** in Host name.
- **A DKIM CNAME blocked** by an old TXT record at the same name.
- **Editing IONOS DNS while custom nameservers are set.**

## Next steps

1. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) to see MX, SPF, DKIM and DMARC together.
2. Fix the SPF record with the [SPF Record Generator](https://iblockspam.com/tools/spf-generator), then build DMARC with the [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator).
3. Confirm DKIM with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker) after signing is on.
4. Moving to Microsoft 365? Our [Microsoft 365 platform page](https://iblockspam.com/platforms/microsoft-365) explains how inbound filtering sits in front of it.

If you later point MX at a filtering service such as iBlockSpam, deactivate any IONOS mail service and add its MX values the same way. More walk-throughs are in [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Why does IONOS show a conflict warning when I add an MX record?

IONOS warns when a new record conflicts with records that belong to an active service, such as IONOS mail. It says MX records for an active service conflict with all other MX records for the same host. Deactivate that service in the DNS settings, or remove its MX records, before adding your new provider's MX records.

### Does IONOS add an SPF record automatically?

Yes, for domains hosted at IONOS. IONOS says its SPF is enabled by default and is automatically supplemented with its mail servers. You can edit or delete that TXT record. If you send from another provider, edit the existing record to include it rather than adding a second SPF record, which IONOS says can cause problems.

### What are the IONOS DKIM CNAME records for?

They publish the DKIM keys IONOS uses to sign mail sent from IONOS mailboxes. IONOS says DKIM is on by default and creates the records automatically on IONOS nameservers. With external DNS you add its three CNAMEs yourself. If you no longer send through IONOS mail, they're harmless, but you can remove them.

### What TTL does IONOS use for DNS records?

IONOS says it uses a time to live of one hour for all DNS settings, and that changes are usually available everywhere within an hour. Its record pages say changes are effective at IONOS immediately. IONOS allows up to 72 hours in exceptional cases, for MX, TXT, CNAME and A records as well as nameserver changes.

### Can I use IONOS DNS records if my domain uses other nameservers?

No. IONOS says that when your domain uses your own or another provider's nameservers, you must create the DNS records with that provider. Records you add in the IONOS DNS page while custom nameservers are active aren't visible on the internet. Our MX Lookup shows which nameservers your domain uses.

## Sources

- [IONOS Help: Managing TXT records](https://www.ionos.com/help/domains/configuring-txt-and-srv-records/managing-txt-records/)
- [IONOS Help: Using a domain with another provider's mail servers (editing MX records)](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/using-a-domain-with-another-providers-mail-servers-editing-mx-records/)
- [IONOS Help: Avoiding DNS conflicts](https://www.ionos.com/help/domains/general-information-about-dns-settings/avoiding-dns-conflicts/)
- [IONOS Help: Using IONOS SPF to improve email delivery](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/using-ionos-spf-to-improve-email-delivery/)
- [IONOS Help: Email authentication with DKIM](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/email-authentication-with-dkim/)
- [IONOS Help: Configuring a DMARC record for a domain](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/configuring-a-dmarc-record-for-a-domain/)
- [IONOS Help: Time required for DNS changes](https://www.ionos.com/help/domains/general-information-about-dns-settings/time-required-for-dns-changes/)
- [RFC 7208: Sender Policy Framework (SPF), section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2)

## Free tools for this guide

- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/add-email-dns-records-ionos (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt