# How do you add email DNS records in Porkbun?

URL: https://iblockspam.com/blog/add-email-dns-records-porkbun
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Setup guides
Author: iBlockSpam Team

> How to add MX, SPF, DKIM and DMARC records in Porkbun DNS: a blank Host for the root, removing Porkbun's default forwarding MX, and checking the result.

## Short answer

In Porkbun, open Domain Management, select DNS under your domain (or Details, then the edit icon next to DNS Records) and click Add Record. Choose MX, TXT or CNAME, leave Host blank for the root domain or enter only the prefix such as _dmarc, paste the Answer from your provider, set Priority for MX, then click Add.

Porkbun's DNS editor is one short form, so adding email records is quick once you know its two habits: the Host field is left **blank** for your root domain, not filled with `@`, and your domain may already carry Porkbun's own email forwarding records. Miss either and mail can go to the wrong place.

This guide walks through MX, SPF, DKIM and DMARC records in Porkbun, using Porkbun's knowledge base for every screen name. If the records themselves are new to you, start with [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc).

## Is your DNS actually hosted at Porkbun?

Porkbun records only work if your domain uses Porkbun's nameservers. Check that first, because Porkbun will happily save records that never get published.

Porkbun's [API documentation](https://porkbun.com/llms/dns) explains why: "we hold a zone for every domain in the account, so a write always succeeds locally," even when the nameservers answering for the domain belong to someone else. A record added that way changes nothing that resolves.

1. In **Domain Management**, select **Details** next to your domain and look at the **Nameservers** field.
2. If it lists Porkbun nameservers, continue with this guide.
3. If it lists another provider, such as Cloudflare or your web host, add your records there instead. Our [Cloudflare guide](https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare) covers the most common case.

Our [MX Lookup](https://iblockspam.com/tools/mx-lookup) also shows which nameservers and mail servers the outside world sees for your domain.

## Where do you add DNS records in Porkbun?

Every record type uses the same **Manage DNS Records** menu ([Porkbun KB](https://kb.porkbun.com/article/231-how-to-add-dns-records-on-porkbun)):

1. Log in. You arrive at **Domain Management**. If you're already logged in, click **ACCOUNT** in the top-right corner and choose **Domain Management**.
2. Click the **DNS** button under the domain name. Alternatively, click **Details**, then the edit icon under **DNS RECORDS**.
3. In **Manage DNS Records**, click **Add Record**.
4. Choose the **Type**, fill in the fields, and click **Add**.
5. Click **Back** to return to the list of records.

At the time of writing (October 2026), the form has these fields:

| Field | What to enter |
|---|---|
| **Type** | MX, TXT or CNAME for email |
| **Host** | Blank for the root domain. Otherwise only the prefix, such as `_dmarc` |
| **Answer/Value** | The record value your provider gives you |
| **TTL** | Seconds. Leave the default unless told otherwise |
| **Priority** | Appears for MX (and SRV) records only |
| **Notes** | Optional notes for yourself; not published in DNS |

Porkbun's API reference says the Host is the "Subdomain for the record (e.g. 'www', '*' for wildcard, blank for root). Do not include the domain name itself." The minimum TTL is "determined by account settings (typically 600)" seconds, and records created through the API without a TTL default to that minimum.

To change a record, click the **pencil icon** next to it, edit the values and save. To remove one, click the **trash can** icon and confirm with **OK** ([Porkbun KB](https://kb.porkbun.com/article/68-how-to-edit-dns-records)). Porkbun notes that if editing throws an error, deleting the record and adding it again usually fixes it.

## What are Porkbun's default email records?

Porkbun's email forwarding and hosting use a standard set of records, which Porkbun's [forwarding guide](https://porkbun.com/llms/guides/set-up-email-forwarding) says are set up when you add an email forward. Its [parking guide](https://kb.porkbun.com/article/183-how-to-reset-dns-and-park-your-domain) lists them as the default Porkbun records related to email:

| Type | Host | Answer | Priority |
|---|---|---|---|
| MX | (blank) | `fwd1.porkbun.com` | 10 |
| MX | (blank) | `fwd2.porkbun.com` | 20 |
| TXT | (blank) | `v=spf1 include:_spf.porkbun.com ~all` | |

These matter when you move mail elsewhere. If you add Microsoft 365 or Google Workspace MX records without deleting Porkbun's, your domain has two sets of mail servers, and senders may deliver to whichever they pick. If you use Porkbun-hosted email, its records also include a DKIM key at `default._domainkey` and a DMARC record at `_dmarc` ([Porkbun KB](https://kb.porkbun.com/article/47-how-to-use-porkbun-email-when-your-dns-is-hosted-elsewhere)).

## How do you add or edit an SPF record in Porkbun?

SPF is a TXT record on the root domain, so its Host is blank. Your domain can have only one. [RFC 7208, section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2) says a domain "MUST NOT have multiple records" that an SPF check would select, and Porkbun's own knowledge base warns that a second SPF record leads to delivery problems.

1. In **Manage DNS Records**, look for a TXT record with a blank Host whose Answer starts with `v=spf1`.
2. If it exists and you still send through Porkbun, click the pencil icon and add your new include before the final `all`. Porkbun's example of a merged record is `v=spf1 include:_spf.porkbun.com include:_spf.emailmarketingtool.example ~all`.
3. If it exists but you no longer send through Porkbun, edit it to replace `include:_spf.porkbun.com` with your new provider's include.
4. If none exists, click **Add Record**, choose **TXT**, leave **Host** blank and paste your record into **Answer**.
5. Click **Add** or save.

Example for a domain on Google Workspace only:

```
Type: TXT   Host: (blank)   Answer: v=spf1 include:_spf.google.com ~all
```

Our [SPF provider pages](https://iblockspam.com/spf) list each service's include, and the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) merges several into one record within the 10-lookup limit.

## How do you add a DKIM record in Porkbun?

Your email provider generates the DKIM key. You publish what it shows you: either a TXT record with the key itself or CNAME records that point to a key the provider hosts.

### DKIM as a TXT record

1. Click **Add Record** and choose **TXT**.
2. Enter the selector host without your domain, for example `google._domainkey`.
3. Paste the key, which starts `v=DKIM1;`, into **Answer** in one piece.
4. Click **Add**.

### DKIM as CNAME records

Microsoft 365 and many sending platforms give you CNAMEs.

1. Click **Add Record** and choose **CNAME**.
2. Enter the host, for example `selector1._domainkey`.
3. Paste the provider's target, for example `selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft`, into **Answer**.
4. Click **Add**, then repeat for `selector2._domainkey`.

Porkbun's [record requirements](https://kb.porkbun.com/article/231-how-to-add-dns-records-on-porkbun) say a CNAME's Host "cannot be left empty and must be unique and cannot be shared with other records," and its Answer must be a fully qualified domain name. If you see "Could not add DNS record: A CNAME or ALIAS record with that host already exists", an older record is using that name. Porkbun's [fix](https://kb.porkbun.com/article/239-cname-alias-record-with-that-host-already-exists-error) is to delete the conflicting record, then add yours.

Once DNS updates, turn signing on in your provider's console. Our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) shows where, and [DKIM records by provider](https://iblockspam.com/dkim) lists each service's selectors.

### What about long 2048-bit keys?

Porkbun's knowledge base doesn't document a length limit for TXT answers at the time of writing (October 2026). Paste the key as one string first. If your provider shows it split into several quoted chunks, that format is also valid: [RFC 6376, section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.2.2) says the strings are joined "with no intervening whitespace" before use. Either way, check the published key with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker). Our guide to [DKIM keys that are too long for a TXT record](https://iblockspam.com/blog/dkim-2048-bit-key-txt-record-too-long) covers the fixes if it comes back truncated.

## How do you add a DMARC record in Porkbun?

DMARC is a TXT record at `_dmarc`.

1. Click **Add Record** and choose **TXT**.
2. Enter `_dmarc` as the **Host**. Don't add your domain; Porkbun does that.
3. Enter your policy as the **Answer**, for example `v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com`.
4. Click **Add**.

If a `_dmarc` record already exists, for example from Porkbun email, edit it rather than adding a second. Start at `p=none` with a reporting address you read, then tighten once reports show every real sender passing. The [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record, and our [none-to-reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the rollout.

## How do you change MX records in Porkbun?

MX records decide where all your incoming mail goes, so plan the switch. Our guide to [changing MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email) covers the timing.

1. Write down your current MX records so you can roll back.
2. Delete MX records you no longer want, such as `fwd1.porkbun.com` and `fwd2.porkbun.com`, with the trash can icon. Porkbun's own email setup instructions say to remove existing root MX records before adding new ones.
3. Click **Add Record** and choose **MX**.
4. Leave **Host** blank, paste the mail server into **Answer**, and set **Priority** to the value your provider gives you.
5. Click **Add**, and repeat for each further MX host.

Parking a domain doesn't touch email. Porkbun says parking "only impacts web hosting." If you later want Porkbun's mail records back, its **Email Hosting and Forwarding** page has a **Fix DNS** button that restores them.

## What does a complete Porkbun email setup look like?

Here is an example for a domain on Microsoft 365 that also sends support email through Zendesk. Your values will differ; the Host column is what people most often get wrong.

| Type | Host | Answer | Priority |
|---|---|---|---|
| MX | (blank) | `example-com.mail.protection.outlook.com` | 0 |
| TXT | (blank) | `v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com ~all` | |
| CNAME | `selector1._domainkey` | target from the Defender portal | |
| CNAME | `selector2._domainkey` | target from the Defender portal | |
| CNAME | `zendesk1._domainkey` | `zendesk1._domainkey.zendesk.com` | |
| CNAME | `zendesk2._domainkey` | `zendesk2._domainkey.zendesk.com` | |
| TXT | `_dmarc` | `v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com` | |

None of the Host values contain the domain, and the root records have a blank Host.

## How do you check the records after saving?

Give the change at least the TTL of any record you replaced, then check each one:

1. **MX** with the [MX Lookup](https://iblockspam.com/tools/mx-lookup): only your new mail servers, no leftover `fwd1.porkbun.com`.
2. **SPF** with the [SPF Checker](https://iblockspam.com/tools/spf-checker): one record, valid syntax, 10 lookups or fewer.
3. **DKIM** with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker) and your selector.
4. **DMARC** with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
5. Send a test message to an outside mailbox and look for `spf=pass`, `dkim=pass` and `dmarc=pass` in its headers. Our [header reading guide](https://iblockspam.com/blog/how-to-read-email-headers) shows where.

## What are the common Porkbun email DNS mistakes?

- **Typing `@` or the full domain into Host.** Leave it blank for the root, and use only the prefix elsewhere.
- **Leaving Porkbun's forwarding MX records** after moving to another mail provider.
- **A second SPF record** next to Porkbun's default one. Edit the existing record.
- **Editing Porkbun DNS when the nameservers point elsewhere.** The records save but don't publish.
- **A leftover record at a DKIM host**, which blocks the new CNAME.

## Next steps

1. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) to see MX, SPF, DKIM and DMARC in one scan.
2. Build your records with the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) and [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator).
3. Starting fresh? Work through the [new domain email setup checklist](https://iblockspam.com/blog/new-domain-email-setup-checklist).
4. Keep watch for accidental changes: the free [Domain Watch](https://iblockspam.com/free-monitoring) checks your public MX, SPF and DMARC records weekly and emails you when they change.

If you later route mail through a filtering service such as iBlockSpam, you'll use the same MX steps with different values. More walk-throughs are in [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Do I type @ in the Porkbun Host field for my root domain?

No. Porkbun's knowledge base says to leave the Host field blank when you add a record to the root domain, such as an MX or SPF record for example.com. For anything else, enter only the prefix, such as _dmarc or selector1._domainkey. Porkbun adds the domain name for you.

### Why does my Porkbun domain have fwd1.porkbun.com MX records?

Those are Porkbun's default email records, used by its email forwarding and hosting: MX records for fwd1.porkbun.com (priority 10) and fwd2.porkbun.com (priority 20), plus the SPF record v=spf1 include:_spf.porkbun.com ~all. If you move mail to another provider, delete those MX records, or some senders will keep delivering to Porkbun.

### What does Porkbun's CNAME or ALIAS record already exists error mean for email?

It means another record already uses that host name. Porkbun says a CNAME's host must be unique and can't be shared with other records. For a DKIM CNAME such as selector1._domainkey, look for an old record at the same host, often left by a previous provider, and delete it before adding the new one.

### What TTL does Porkbun use for DNS records?

Porkbun's API documentation says the minimum TTL is set by account settings, typically 600 seconds (10 minutes), and records created without a TTL default to that minimum. Porkbun's knowledge base suggests leaving the TTL field at its default unless a provider tells you otherwise, which suits most email records.

### Can I edit Porkbun DNS records if my domain uses Cloudflare nameservers?

You can save them, but they won't do anything. Porkbun's API documentation says it keeps a zone for every domain, so writes succeed even when the domain is delegated elsewhere, yet they change nothing that resolves. Add email records at whichever provider your nameservers point to.

## Sources

- [Porkbun Knowledge Base: How to Add DNS Records on Porkbun](https://kb.porkbun.com/article/231-how-to-add-dns-records-on-porkbun)
- [Porkbun Knowledge Base: How to Edit DNS Records](https://kb.porkbun.com/article/68-how-to-edit-dns-records)
- [Porkbun Knowledge Base: How to use Porkbun email when your DNS is hosted elsewhere](https://kb.porkbun.com/article/47-how-to-use-porkbun-email-when-your-dns-is-hosted-elsewhere)
- [Porkbun Knowledge Base: How to reset DNS and park your domain](https://kb.porkbun.com/article/183-how-to-reset-dns-and-park-your-domain)
- [Porkbun Knowledge Base: "A CNAME or ALIAS record with that host already exists" error](https://kb.porkbun.com/article/239-cname-alias-record-with-that-host-already-exists-error)
- [Porkbun API v3: DNS records reference](https://porkbun.com/llms/dns)
- [RFC 7208: Sender Policy Framework (SPF), section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2)
- [RFC 6376: DomainKeys Identified Mail (DKIM), section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.2.2)

## Free tools for this guide

- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/add-email-dns-records-porkbun (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt