How to set up SPF, DKIM, and DMARC in Porkbun

Setting up SPF, DKIM, and DMARC in Porkbun comes down to publishing three TXT records in one clean DNS editor. Porkbun is a developer-friendly registrar, so the DNS controls are refreshingly plain — no upsells, no buried menus, just a type dropdown, a host field, and an answer box. The records themselves are identical to what you'd add at any other host; what changes is only where you click and what goes in the host field. This guide walks through all three, in the right order, with the Porkbun-specific naming you need to get right.

The short answer#

Email authentication is three separate TXT records, and none of them are unique to Porkbun:

• SPF — one TXT record at your root domain (leave the host field blank), value starting v=spf1.
• DKIM — one TXT record at <selector>._domainkey, where the selector and the long public-key value both come from your email provider, not from Porkbun.
• DMARC — one TXT record at _dmarc, value starting v=DMARC1, and you always start it at p=none.

In Porkbun you add all three from Domain Management → Details → DNS Records. The only per-record differences are the host name and the value. Get the host field right and everything else follows. For the conceptual "why," see the SPF, DKIM, and DMARC explainer; this article is the button-by-button Porkbun version.

Where Porkbun keeps your DNS records#

Porkbun folds DNS into its main domain dashboard rather than a separate product, which keeps things fast to find. After you log in:

1. Open Domain Management from the account menu — it lists every domain in your account.
2. Find the domain you're authenticating and click its Details control (the expandable row, sometimes shown as a caret or a "Details" link).
3. Inside the expanded panel, choose DNS Records (you may also see it labelled "Edit" for DNS). This opens the editor where existing records are listed and a small form lets you add a new one.

The add-record form has three parts that matter for authentication: a Type dropdown (choose TXT), a Host field (what subdomain the record sits on), and an Answer field (also called Content or Value on some views — this holds the record's text). There's a TTL field too; the default is fine, so leave it alone.

The one Porkbun convention to internalise: the Host field is relative to your domain, and you leave it blank for the root. Porkbun does not want you to type the full domain in the host field. That single habit is what trips people up, so the sections below spell out exactly what to enter for each record.

Publishing your SPF record in Porkbun#

SPF declares which servers are allowed to send mail using your domain. It's a single TXT record that lives at your root domain — and in Porkbun's editor, the root domain means an empty Host field.

First, get your value right. SPF must list every service that sends mail as you: your email platform, your marketing tool, your transactional provider. Rather than hand-assemble the include: mechanisms and risk a typo, build it with the free SPF record generator, which produces a single valid record from the senders you pick.

A finished SPF value looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

To publish it in Porkbun:

1. In the DNS Records editor, set Type to TXT.
2. Leave the Host field blank (this targets the root domain). If Porkbun shows a greyed-out placeholder of your domain, that's the hint that empty = root.
3. Paste the full v=spf1 … string into the Answer field.
4. Save the record.

That ~all at the end is a soft-fail; -all is a hard-fail that tells receivers to reject anything not listed. Start with ~all while you confirm every sender is included, then tighten to -all once your reports are clean.

Adding your DKIM record in Porkbun#

DKIM attaches a cryptographic signature to each message; you publish the matching public key in DNS so receivers can verify it. This is the record where the values come entirely from your email provider — Google Workspace, Microsoft 365, SendGrid, Mailgun, and so on. Porkbun cannot generate a DKIM key for you, and neither can any generator, because the private half lives inside your sending platform. Your provider hands you two things: a selector and a public-key value.

The record's host is built from the selector, following the fixed pattern <selector>._domainkey. Say your provider gives you the selector google — the DKIM record for Google Workspace typically uses that selector. The full record name becomes google._domainkey.yourdomain.com.

Here's the Porkbun-specific part: because the Host field is relative to your domain, you enter only the portion before your domain. So for that example you would type:

google._domainkey

into the Host field — not the full google._domainkey.yourdomain.com. Porkbun appends your domain automatically.

Steps:

1. In your email provider's admin console, find the DKIM (sometimes "email authentication" or "domain authentication") setup and copy the selector and the public-key value it gives you.
2. In Porkbun's DNS Records editor, set Type to TXT.
3. In Host, enter <selector>._domainkey — for example s1._domainkey or google._domainkey, using whatever selector your provider specified.
4. Paste the provider's public-key value (it usually starts v=DKIM1; k=rsa; p=… and is very long) into the Answer field. Paste it whole, exactly as given — a single altered character breaks the signature.
5. Save.

A DKIM record you're pasting will resemble this shape, though your p= value will be far longer:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...

Publishing your DMARC record in Porkbun#

DMARC ties SPF and DKIM to the visible "From" address, tells receivers what to do with mail that fails, and sends you reports. It lives at the fixed hostname _dmarc, so in Porkbun's Host field you enter exactly:

_dmarc

and nothing more. Porkbun turns that into _dmarc.yourdomain.com for you.

Build the value with the free DMARC record generator so the tag syntax is correct, and always start with p=none. A safe starting record:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Steps:

1. In the DNS Records editor, set Type to TXT.
2. In Host, enter _dmarc.
3. Paste the v=DMARC1; p=none; rua=… value into the Answer field, using a real mailbox you can read for the rua= reporting address.
4. Save.

p=none enforces nothing yet — it switches on the daily aggregate reports that make a safe rollout possible. Leave it there for a couple of weeks, read the reports to confirm every legitimate mail stream authenticates in alignment, then step the policy up to quarantine and finally reject. The full sequence, including how to interpret what comes back, is covered in the step-by-step DMARC setup guide and the companion on how to read DMARC reports.

The three records at a glance#

Here's every record side by side, showing exactly what goes in Porkbun's Host field versus what belongs in the Answer field.

Note the pattern: only the DMARC and DKIM records get a host name, and only the DKIM value and selector come from an outside source. The SPF host is empty because SPF always sits at the root domain.

Verify the records resolved#

DNS changes at Porkbun usually propagate quickly, but give them anywhere from a few minutes to a few hours before you trust them. Rather than eyeball the raw zone, run all three through the free SPF, DKIM, and DMARC checker — it confirms each record is present, well-formed, and readable by receivers, and it flags the classic mistakes: a duplicate SPF record, a DKIM value with a stray line break, or a DMARC record sitting at the wrong host.

If the checker can't find a record, the usual Porkbun culprit is the Host field: you either typed the full domain where it should have been blank or relative, or you put the DKIM selector in the wrong place. Re-open the record, confirm the host is exactly blank for SPF, _dmarc for DMARC, or <selector>._domainkey for DKIM, and save again.

Porkbun also exposes a full DNS API, so if you manage many domains you can script these records rather than clicking through each one — handy when you're rolling the same authentication setup across a portfolio. The record contents you'd send via the API are identical to what's above.

Why bother getting all three right#

Since 2024, the Google and Yahoo sender requirements have made this non-optional. Every sender to Gmail needs SPF or DKIM, and bulk senders — more than 5,000 messages a day — must have all three, with DMARC and alignment, plus one-click unsubscribe on marketing mail. Miss them and modern providers increasingly reject the mail outright.

But authentication only proves who you are — it doesn't make you a good sender. A perfectly authenticated message from a domain with a poor sender reputation or a list full of dead addresses still lands in spam. Treat these three Porkbun records as the entry ticket, then do the work that earns placement: keep your spam complaint rate low, and clean your list so you aren't mailing addresses that bounce. The deliverability guide covers the rest.

Frequently asked questions#

What do I put in Porkbun's Host field for an SPF record?#

Leave it blank. SPF is a TXT record that lives at your root domain, and in Porkbun the empty Host field targets the root — Porkbun fills in your domain automatically. Do not type your domain name into the host box, and never publish a second v=spf1 record; if one already exists, edit it to add the new sender.

Where does the DKIM value in Porkbun come from?#

Entirely from your email provider, not from Porkbun or any generator. Your ESP — Google Workspace, Microsoft 365, SendGrid, Mailgun, and so on — gives you a selector and a long public-key value. In Porkbun you set the Host to <selector>._domainkey and paste the provider's value, exactly as given, into the Answer field. Porkbun only stores the key; it can't create one.

How do I enter a DMARC record in Porkbun?#

Add a TXT record with the Host field set to _dmarc and the Answer field set to your DMARC value, starting at v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Porkbun expands _dmarc into _dmarc.yourdomain.com for you. Always begin at p=none so you monitor with reports before enforcing, then tighten to quarantine and reject once the reports are clean.

Why can't the checker find the records I just added in Porkbun?#

Usually one of two things: DNS hasn't propagated yet — wait a few minutes to a few hours — or the Host field is wrong. Confirm the host is blank for SPF, _dmarc for DMARC, and <selector>._domainkey for DKIM, with no full domain typed in. Re-run the SPF, DKIM, and DMARC checker after correcting and saving.

Authenticating your domain in Porkbun gets your mail trusted; a clean list is what gets it delivered. Run your addresses through the free email checker to strip dead addresses and typos before they bounce — because a trusted identity only earns the inbox when the list behind it is clean. Explore all the free deliverability tools to generate and verify every record above.