SPF record for Postmark

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Optional custom Return-Path (CNAME, not TXT)

Type: CNAME · Host: pm-bounces Copy

pm.mtasv.net

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Postmark mail

Postmark sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• Either DKIM or SPF alignment is enough to pass DMARC, so DKIM alone covers Postmark mail.
• Postmark's custom Return-Path is always a subdomain, so keep aspf=r (relaxed, the default) in your DMARC record. With aspf=s, Postmark mail can't pass DMARC through SPF.

How to add it

1. Set up DKIM for your sending domain in Postmark first: Postmark calls it the standard for email authentication.
2. If you want SPF alignment too, add a CNAME record pm-bounces (the default label) pointing to pm.mtasv.net.
3. In Postmark, open Signatures, choose DNS Settings for your domain and enter the Return-Path you created.
4. Leave your main domain's SPF record unchanged.

DKIM and DMARC alignment

Postmark recommends DKIM as the main way to authenticate. With DKIM on your domain and an optional pm-bounces Return-Path, Postmark mail passes DMARC through both checks. Keep SPF alignment relaxed in your DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Postmark adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding a Postmark include to your root SPF record. Postmark says it is no longer required; it only spends lookups.
• Setting aspf=s in DMARC while relying on Postmark's Return-Path for SPF alignment.