IONOS hosts my domain and my email — do I even need to do anything?

Partly. When you use IONOS nameservers with IONOS Mail, IONOS auto-publishes the SPF (via its "IONOS SPF (TXT)" record) and the three DKIM CNAMEs, so those are usually already in place. But IONOS never creates DMARC — you must add a _dmarc TXT record yourself — and you should still verify on a live message that SPF, DKIM, and DMARC all pass aligned to your domain.

Do I use _spf-eu.ionos.com or _spf-us.ionos.com?

It depends on which IONOS platform your mailboxes live on, not on your country. European-platform accounts use include:_spf-eu.ionos.com; accounts on the US ionos.com platform use include:_spf-us.ionos.com. If you're not sure, check the mail/SMTP server host IONOS assigned you or ask IONOS support — using the wrong region silently softfails all your mail.

My DNS is at Cloudflare/GoDaddy but I use IONOS email. What do I add?

Everything manually, at your real DNS host: add include:_spf-eu.ionos.com (or _spf-us) to your one SPF record, create the three DKIM CNAMEs (s1-ionos, s2-ionos, and your account's numeric selector, each pointing to the matching *.dkim.ionos.com host), and add a _dmarc TXT record. IONOS's auto-management only works when IONOS is your nameserver.

I added the include but SPF still fails — why?

Three usual causes: you used the wrong regional include (EU vs US), you now have two SPF records on the domain (a PermError), or the failing mail is actually going out through Microsoft 365/another service rather than IONOS Mail, so it needs that provider's records instead. Check with dig TXT yourdomain.com that there's exactly one v=spf1 line with the correct include.

How many SPF lookups does the IONOS include cost?

One. include:_spf-eu.ionos.com resolves to a flat list of ip4: ranges with no nested includes, so it consumes a single lookup of your ten. That leaves plenty of room to merge other senders — but keep watching the limit if you stack several providers.

I use IONOS mail and a third-party ESP like SendGrid or Mailchimp. How do I combine them?

Keep one SPF record and merge every mechanism into it — for example v=spf1 include:_spf-eu.ionos.com include:sendgrid.net ~all. DKIM won't collide because each provider uses its own selectors, and DMARC is a single shared record. Just watch the 10-lookup SPF limit as you add includes.

Does IONOS set up DMARC automatically?

No. IONOS may auto-manage SPF and DKIM when it's your nameserver, but DMARC is always yours to publish. Add a _dmarc TXT record starting at p=none, confirm IONOS mail passes aligned in the aggregate reports, then move to p=quarantine and p=reject.

SPF setup guide

SPF, DKIM & DMARC for IONOS.

IONOS is unusual because it is often both your DNS host and your mail host at the same time, so "authenticating your domain on IONOS" depends entirely on where your nameservers point. If your domain uses IONOS nameservers (the default when you register or host with IONOS) and you send from IONOS mailboxes, IONOS has already published most of the records for you — an auto-maintained "IONOS SPF (TXT)" entry and three CNAME records that delegate DKIM — and your real job is to confirm they exist, add the one record IONOS never creates (DMARC), and verify on a live message. If your DNS lives somewhere else (Cloudflare, GoDaddy, Route 53) but your mailboxes are on IONOS, then you add it all by hand: the shared SPF include, the three DKIM CNAMEs, and DMARC. Either way, "sending as your domain" here means IONOS Mail mailboxes, IONOS webmail, IONOS-hosted contact forms — and note that Microsoft 365/Exchange resold through IONOS authenticates a different way entirely.

SPF include

Your DNSAdd the CNAME / TXT records

IONOSSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate IONOS?

On IONOS the stakes are the same as anywhere — Gmail and Yahoo have junked or rejected unauthenticated bulk mail since their February 2024 sender rules, and any mailbox treats an unaligned message as suspicious — but IONOS sets a specific trap. When IONOS is both your registrar and your nameserver, it quietly publishes SPF and DKIM for you, so mail often passes those two checks straight out of the box and everything looks fine. What IONOS never publishes is DMARC, and without a _dmarc record you have no policy, no alignment enforcement, and no aggregate reports — so you can't see that, say, your marketing tool or contact form is sending unaligned, and you don't meet the DMARC expectation Gmail and Yahoo now enforce at volume. The job on IONOS is rarely "set up all three from scratch"; it's confirm the two IONOS already did, add the one it didn't, and prove all three align to your own domain rather than to ionos.com.

The SPF reality for IONOS

IONOS uses the shared-include model: every IONOS mailbox sends through a fixed pool of IONOS mail servers published behind one include — include:_spf-eu.ionos.com for the European platform or include:_spf-us.ionos.com for the US platform. That include resolves to a flat list of IONOS ip4: ranges with no nested includes, so it costs exactly one of your ten SPF lookups. How you publish it depends on who runs your DNS. If IONOS is your nameserver, you never hand-type v=spf1 at all — the DNS editor has a dedicated "IONOS SPF (TXT)" record type that IONOS adds by default and keeps current as its sending IPs change; you just confirm it's present. If your DNS lives elsewhere, you fold the include into your existing root SPF by hand, keeping it to a single TXT record — v=spf1 include:_spf-eu.ionos.com ~all — and merge any other senders into that same line. Two separate v=spf1 records is a PermError that breaks SPF for the whole domain, and it's the single most common way IONOS SPF gets accidentally disabled.

Two ways to set it up

Recommended

IONOS hosts your DNS (mostly auto-managed)

IONOS publishes the SPF automatically via the "IONOS SPF (TXT)" record type and keeps it current
The three DKIM CNAMEs are created for you when you use IONOS nameservers + IONOS Mail
You mainly confirm the records exist and add the one IONOS never creates — DMARC
Costs one SPF DNS lookup; nothing to merge unless you add other senders

Legacy

DNS hosted elsewhere (manual)

You add include:_spf-eu.ionos.com (or _spf-us) to your root SPF yourself
You create all three DKIM CNAMEs by hand — s1-ionos, s2-ionos, and the account-specific numeric selector
You add DMARC yourself and merge the include with any other senders
The IONOS DNS panel is not authoritative — edit records at your real DNS host

Step by step

In the IONOS control panel

1
Open the DNS editor
Sign in at ionos.com, open Menu → Domains & SSL, find the domain, then under Actions click the gear (or three-dots) icon and choose DNS. This opens the DNS record list for the domain.
2
Confirm which platform (EU or US) your mail is on
Before touching SPF, note your account's data-center region — European mailboxes use the EU platform, accounts on the US ionos.com platform use the US one. This determines whether you need _spf-eu.ionos.com or _spf-us.ionos.com. If unsure, check the SMTP/mail server host IONOS gave you or ask IONOS support; guessing wrong silently softfails all mail.
3
Check what IONOS already publishes
If your domain uses IONOS nameservers and you send from IONOS Mail, scan the record list first: you'll usually already see an IONOS SPF (TXT) entry plus three CNAMEs named s1-ionos._domainkey, s2-ionos._domainkey, and a numeric selector like sXXXXXXXX._domainkey. If they're there, don't duplicate them — skip to adding DMARC and verifying.

In your DNS

4
Publish or confirm SPF
On IONOS DNS: click Add record → IONOS SPF (TXT) and Save — IONOS maintains the correct value and merges it with any existing SPF. On external DNS: add a TXT record with host @ and value v=spf1 include:_spf-eu.ionos.com ~all (use _spf-us.ionos.com if you're on the US platform). If an SPF record already exists, merge the include into that one line — never create a second SPF record.
5
Add the three DKIM CNAMEs
On IONOS DNS these are auto-created; on external DNS add all three as CNAME records — host s1-ionos._domainkey → s1.dkim.ionos.com, host s2-ionos._domainkey → s2.dkim.ionos.com, and host sXXXXXXXX._domainkey → sXXXXXXXX.dkim.ionos.com. The numeric selector is unique to your account — copy it exactly from the IONOS panel, don't invent it. Enter only the host label; IONOS appends your domain automatically.
6
Turn off any external proxy on the CNAMEs
If your DNS is behind Cloudflare, set each DKIM CNAME to "DNS only" (grey cloud). An orange-cloud proxy rewrites the CNAME target and DKIM verification fails.
7
Add the DMARC record
IONOS never creates DMARC for you. Add a TXT record with host _dmarc and value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so it won't affect delivery while you confirm alignment — you'll tighten it later.

Verify

8
Wait for propagation
IONOS says changes can take up to 48 hours to propagate globally, though it's usually much faster. The default TTL on IONOS records is one hour. Don't judge the setup until DNS has had time to update.
9
Send a test and read the headers
Send a message from your IONOS mailbox to a Gmail account, open it, and use ⋮ → Show original. You want SPF: PASS, DKIM: PASS with a signature by yourdomain.com (selector s1-ionos or s2-ionos), and DMARC: PASS — all aligned to your domain, not to ionos.com.
10
Repeat for every sending domain
SPF, DKIM, and DMARC are per-domain. If you send from multiple domains hosted at IONOS, each needs its own IONOS SPF, its own DKIM CNAMEs, and its own _dmarc record.

Records to add

IONOS generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	@	v=spf1 include:_spf-eu.ionos.com ~allRoot SPF for EU-platform mailboxes. US-platform accounts use include:_spf-us.ionos.com instead. If IONOS hosts your DNS, add this via Add record → "IONOS SPF (TXT)", which auto-maintains it. Keep just one SPF record and merge other senders into this line.
CNAME	s1-ionos._domainkey	s1.dkim.ionos.comDKIM selector 1 — CNAME-delegated to IONOS. Auto-created when IONOS is your nameserver; add manually on external DNS.
CNAME	s2-ionos._domainkey	s2.dkim.ionos.comDKIM selector 2 — the rotation partner to s1-ionos.
CNAME	sXXXXXXXX._domainkey	sXXXXXXXX.dkim.ionos.comIllustrative — the numeric selector is unique to your account (e.g. s42582890). Copy the exact value from the IONOS DNS panel; do not guess it.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYour DMARC policy — IONOS never creates this. One per domain. Start at p=none, then tighten to quarantine/reject.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what IONOS's setup costs against that budget.

SPF 10-lookup budget1 used · 9 free

IONOS adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

DKIM on IONOS is CNAME-delegated, never a pasted key. You publish three CNAME records — s1-ionos._domainkey and s2-ionos._domainkey (a rotating pair) pointing to s1.dkim.ionos.com and s2.dkim.ionos.com, plus one account-specific numeric selector such as s42582890._domainkey pointing to the matching s42582890.dkim.ionos.com. Because the real public keys live at IONOS behind those CNAMEs, IONOS can rotate keys without you ever touching DNS — that's the whole point of the delegation, and the reason you must never try to publish a raw DKIM TXT key for an IONOS mailbox. When IONOS is your nameserver, all three are auto-created the moment the domain has IONOS Mail; on external DNS you add all three by hand and must copy the numeric selector exactly from the IONOS DNS panel — it is unique to your account and cannot be guessed. Microsoft 365 mailboxes resold by IONOS are the exception: their DKIM is managed in Microsoft, not via these CNAMEs.

DMARC

DMARC is the one record IONOS will not publish for you, even when it auto-manages SPF and DKIM — so on nearly every IONOS domain it is simply missing until you add it. Create a single TXT record at host _dmarc with a monitor-only policy to start: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none changes nothing about delivery; it just switches on the aggregate reports that show which sources — IONOS Mail, your ESP, your contact form — are passing and aligned. Once the reports confirm your legitimate IONOS mail authenticates cleanly, tighten the policy to p=quarantine and then p=reject. That final step is what actually satisfies the enforced-DMARC expectation from Gmail and Yahoo; SPF and DKIM alone don't.

Check it actually worked

Don't trust the DNS panel — verify on a real message. Send from your IONOS mailbox to a Gmail address, open the mail, and choose ⋮ → Show original. You want three PASS lines, all aligned to your domain (not to ionos.com): SPF: PASS from an IONOS IP, DKIM: PASS signed by yourdomain.com with selector s1-ionos or s2-ionos, and DMARC: PASS. From the command line, dig TXT yourdomain.com should return exactly one v=spf1 line, and dig CNAME s1-ionos._domainkey.yourdomain.com should resolve to s1.dkim.ionos.com. Remember IONOS propagation can take up to 48 hours on a default one-hour TTL, so a fail immediately after saving is usually just timing. Our domain health check runs all of these at once and flags anything unaligned.

Domain health check DMARC report analyzer

Common gotchas

Coverage
EU vs US is the #1 IONOS mistake: European-platform mailboxes need include:_spf-eu.ionos.com, US-platform accounts need include:_spf-us.ionos.com. The wrong one authorizes the wrong data-center IPs and softfails every message even though the record looks correct. Match it to your account's region, not your own location.
Breaks auth
If IONOS hosts your DNS, don't paste a manual SPF line — IONOS already publishes and maintains one via the "IONOS SPF (TXT)" record type. Adding your own v=spf1 line on top creates two SPF records, which is a PermError and breaks SPF entirely.
Coverage
IONOS's own _spf-eu.ionos.com record ends in ?all (neutral), not ~all. You can't change that — it's IONOS's record — but keep your outer record at ~all and don't copy the neutral qualifier onto your own SPF.
DNS setup
DKIM is CNAME-delegated, so never try to paste a DKIM TXT key for IONOS mailboxes. If you deleted the CNAMEs, re-add s1-ionos._domainkey, s2-ionos._domainkey, and the account-specific numeric selector — and copy that numeric selector exactly from your panel; it's unique to your account.
DNS setup
Microsoft 365 or Exchange bought through IONOS is authenticated in Microsoft, not via the s1-ionos CNAMEs. DKIM for those domains is configured in the Microsoft 365 Defender portal (and Exchange Online now applies a default DKIM signature to outbound mail automatically, even before you set up a custom selector). The IONOS s1-ionos/s2-ionos CNAMEs only cover IONOS's own mailboxes.
DNS setup
If your nameservers point away from IONOS, the IONOS DNS panel is not authoritative and its auto-managed SPF/DKIM won't apply — you must add the include and CNAMEs at your real DNS host.
DNS setup
On Cloudflare or any proxying DNS, set the DKIM CNAMEs to DNS-only (grey cloud). A proxied CNAME rewrites the target and DKIM verification fails.
Coverage
Give it time: IONOS states propagation can take up to 48 hours, and its default record TTL is one hour. A test that fails immediately after saving is usually just propagation, not a broken record.

Build your SPF record

IONOS is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

IONOSinclude:_spf-eu.ionos.comGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:_spf-eu.ionos.com ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list