SPF, DKIM & DMARC for OVHcloud.
OVHcloud is a domain registrar, DNS host, and email provider rolled into one, so for most OVH customers SPF, DKIM, and DMARC all get configured inside the same OVHcloud Control Panel — often with one-click helpers. OVH's shared mail platform (the free MX Plan that ships with a domain, the paid MX Plan, Email Pro, and Hosted Exchange) authenticates SPF with a genuine shared include, include:mx.ovh.com, and — a relatively recent addition — one-click DKIM you switch on from the mail product's own dashboard. This guide walks the exact panel paths, the record shapes OVH generates, and the DMARC record you still have to add yourself.
Why authenticate OVHcloud?
Authenticating your OVH-hosted domain isn't housekeeping — it decides whether your mail reaches the inbox. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began rejecting non-compliant mail in 2025. Even below that threshold, unauthenticated mail from an OVH mailbox lands in spam or gets silently dropped, and a missing DMARC policy leaves your domain open to spoofing. The upside on OVH is that all three records live where your domain already does: the include:mx.ovh.com SPF aligns to your own domain, one-click DKIM signs as d=yourdomain.com, and a DMARC policy you add on top ties it together — so a correctly configured OVH domain passes cleanly for Gmail, Yahoo, and Microsoft alike.
The SPF reality for OVHcloud
OVHcloud is a genuine SPF "include" provider: mx.ovh.com is a real shared record, and your root SPF should be v=spf1 include:mx.ovh.com ~all. This is the mechanism OVH itself recommends, and OVH gives you a one-click "Use the SPF for OVHcloud web hosting" button in the DNS-zone add-entry wizard that writes it for you. It matters more here than for a marketing ESP because OVH mailboxes send with an envelope MAIL FROM on your own domain, so SPF actually ALIGNS to your organizational domain and contributes a DMARC pass on its own — not just DKIM. Under the hood, mx.ovh.com isn't a plain ip4/ip6 list: it authorizes OVH's outbound servers mostly by reverse DNS, with two ptr mechanisms (ptr:mail-out.ovh.net and ptr:mail.ovh.net) backed by a couple of IPv4 blocks and a neutral ?all. Because each ptr term is itself a DNS lookup, the include consumes three of your ten SPF lookups — one for the include plus one for each ptr — rather than one, though there's no nested include chain and you're left with seven for other senders. Two things to get right. First, OVH publishes regional variants (mx.ovh.com is the standard host; some Canada-region accounts have historically seen mx.ovh.ca) — use whatever the one-click helper pre-fills for your account rather than hand-typing a host. Second, there must be exactly one SPF TXT record on the domain: OVH's helper cheerfully creates a fresh v=spf1 include:mx.ovh.com ~all, so if you already send through Google Workspace, Microsoft 365, or an ESP, don't let it add a second SPF record — merge include:mx.ovh.com into your existing line instead (two SPF records is a PermError). OVH's wizard lets you choose the failure policy — softfail (~all) or hardfail (-all); keep ~all until you're certain every legitimate sender is listed, then tighten to -all for the strongest anti-spoofing.
Two ways to set it up
DNS zone hosted at OVHcloud — auto-configured (recommended)
- One click adds v=spf1 include:mx.ovh.com via the "Use the SPF for OVHcloud web hosting" helper
- Enabling DKIM writes both selector CNAMEs into your zone for you — nothing to paste
- OVH holds and rotates the DKIM keys across two selectors automatically
- You only add the DMARC record yourself
External nameservers — records added by hand
- You add v=spf1 include:mx.ovh.com ~all as a TXT at your DNS host
- The DKIM activation dialog hands you two CNAME values to paste before you click Enable
- On Cloudflare, set the DKIM CNAMEs to "DNS only" (grey cloud) so they resolve
- Same include and same DMARC — only who writes the records changes
Step by step
- 1
Find which OVH mail product you have
SPF is identical across all three, but the DKIM toggle lives in a different tab per product. Free 1-address MX Plan and paid MX Plan: Web Cloud > MX Plan. Email Pro: Web Cloud > Email Pro. Hosted Exchange: Web Cloud > Microsoft > Exchange. Note which one you use before you start.
- 2
Open your DNS zone
In the OVHcloud Control Panel go to Web Cloud > Domain names, select your domain, open the DNS zone tab, and click Add an entry at the top-right.
- 3
Use the one-click OVH SPF helper
Choose the SPF record type, then tick "Use the SPF for OVHcloud web hosting" — OVH fills in v=spf1 include:mx.ovh.com. Leave the failure policy on ~all (softfail) for now and Save. IMPORTANT: if you already have an SPF TXT record (Google, Microsoft 365, an ESP), do NOT create a second one — cancel the helper and instead edit your existing record to add include:mx.ovh.com.
- 4
Open the DKIM control for your product
For MX Plan, open your domain under Web Cloud > MX Plan and look at the General information tab — the DKIM status shows as a red badge. (Email Pro / Exchange: open the Associated domains tab instead, where the same red DKIM badge appears next to the domain.)
- 5
Activate DKIM
Click the red DKIM badge, then Validate/Enable. If your domain's DNS zone is hosted at OVH on the same account, OVH writes the two selector CNAMEs for you automatically. If your nameservers are external, the dialog shows two CNAME values — add both at your DNS host first, then click Enable (don't enable before they're in place).
- 6
Wait for the badge to turn green
Automatic DKIM activation takes 30 minutes to a maximum of 24 hours as the keys publish and propagate. The badge changes from red to green once OVH confirms the selectors resolve. OVH provisions two selectors (…-selector1 and …-selector2) so it can rotate keys later without you touching DNS.
- 7
Publish a DMARC policy yourself
OVH does not create DMARC for you. Back in DNS zone > Add an entry, add a record at the subdomain _dmarc (OVH's built-in DMARC wizard is limited to a few tags, so a plain TXT record is often the better choice) with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none so it only monitors while you confirm alignment.
- 8
Confirm on a real message
Send yourself a test from your OVH mailbox, open it in Gmail, and choose the three-dot menu > Show original. You want SPF: PASS, DKIM: PASS, and DMARC: PASS all showing your own domain. Then run the domain through a checker to confirm every record resolves.
Records to add
OVHcloud generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:mx.ovh.com ~allRoot SPF — OVH's one-click helper writes this. The include resolves to OVH's ptr/ip4 record and counts as 3 of your 10 SPF lookups. If you already have an SPF record (Google, Microsoft 365, an ESP), merge include:mx.ovh.com into it instead of adding a second. |
| CNAME | ovhmo1234567-selector1._domainkey | ovhmo1234567-selector1._domainkey.1500.aj.dkim.mail.ovh.net.DKIM selector 1 — illustrative; your prefix and target are generated per account (MX Plan uses ovhmo…, Email Pro ovhemp…, Exchange ovhex…). Keep the trailing dot. |
| CNAME | ovhmo1234567-selector2._domainkey | ovhmo1234567-selector2._domainkey.1500.aj.dkim.mail.ovh.net.DKIM selector 2 — the second key OVH rotates to automatically. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYour DMARC policy — add it yourself; keep exactly one per domain. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what OVHcloud's setup costs against that budget.
OVHcloud adds 3 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM on OVHcloud is a control-panel toggle, not a key you paste in. For MX Plan, open Web Cloud > MX Plan > your domain > General information; the DKIM status shows as a red badge. Click it and choose Validate, and OVH provisions two selectors — ovhmoXXXXXXX-selector1 and ovhmoXXXXXXX-selector2 — as CNAME records that delegate to OVH's signing infrastructure (targets look like ovhmoXXXXXXX-selector1._domainkey.NNNN.aj.dkim.mail.ovh.net., trailing dot included). Because they are CNAMEs pointing back to OVH rather than TXT keys, OVH holds the private keys and rotates between the two selectors for you — you never copy a public key or re-edit DNS. If your domain's DNS zone is hosted at OVH on the same account, OVH writes both CNAMEs automatically; if your nameservers are external (Cloudflare, another registrar), the activation dialog hands you the two CNAME values to add at your DNS host first, and only then do you click Enable. Activation takes 30 minutes to 24 hours, and the badge turns from red to green when the keys resolve. Email Pro and Hosted Exchange work the same way but under a different path (Web Cloud > Email Pro or Web Cloud > Microsoft > Exchange, then the Associated domains tab) and with ovhemp… / ovhex… selector prefixes. One note: one-click DKIM for the free/basic MX Plan is a relatively recent addition — older guides that say "DKIM is only available on Exchange or Email Pro" are out of date.
DMARC
OVHcloud does not create a DMARC record for you — you add it yourself. In the same DNS zone > Add an entry wizard, add a record at the subdomain _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. OVH does offer a dedicated DMARC entry (Add an entry > Mail records > DMARC), but its wizard exposes only a subset of tags — choosing a plain TXT record instead gives you full control over p, sp, pct, rua, and ruf. p=none is monitor-only: it collects aggregate reports without affecting delivery while you confirm OVH mail passes SPF and DKIM aligned to your domain. After a week or two of clean reports, tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole domain no matter how many senders you use, and point rua at a mailbox you actually watch (or a DMARC reporting service) so the reports don't pile up unread.
Check it actually worked
Don't trust the green DKIM badge alone — confirm it on a real message. Send yourself an email from your OVH mailbox, open it in Gmail, and choose the three-dot menu > Show original: you want SPF: PASS and DKIM: PASS both showing your own domain, plus DMARC: PASS. Prefer a written report? Email check-auth@verifier.port25.com and it replies with a full breakdown. Run your domain through Qualisend's domain health check to confirm the mx.ovh.com include, both DKIM selector CNAMEs, and your _dmarc record all resolve correctly, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — OVHcloud should show up as an aligned, passing source.
Common gotchas
- Coverage
MX Plan DKIM is newer than the internet thinks. For years OVH only offered DKIM on Exchange and Email Pro, and many old forum threads and third-party guides still say MX Plan can't do DKIM. It can now — use the one-click badge on the General information tab instead of trying to sign externally.
- DNS setup
The include costs 3 SPF lookups, not 1. mx.ovh.com authorizes OVH's servers mostly by reverse DNS — it holds two ptr mechanisms (ptr:mail-out.ovh.net, ptr:mail.ovh.net) plus a couple of ip4 blocks, and each ptr term counts as a DNS lookup on top of the include. Budget three of your ten lookups for it when you stack other senders.
- DNS setup
Auto-config only works if your DNS zone is at OVH. OVH can write the SPF and DKIM records for you only when the domain's DNS zone lives on the same OVH account. If your nameservers point elsewhere (Cloudflare, GoDaddy, another registrar), you must paste the two DKIM CNAMEs at that host BEFORE clicking Enable, and add the SPF TXT there by hand.
- Breaks auth
Never end up with two SPF records. OVH's "Use the SPF for OVHcloud web hosting" helper creates a fresh v=spf1 include:mx.ovh.com ~all. If you already have an SPF record for Google Workspace, Microsoft 365, or an ESP, publishing a second one is a PermError — merge include:mx.ovh.com into your existing single record instead.
- DNS setup
Keep the trailing dot on DKIM targets. OVH's CNAME values end with a period (…dkim.mail.ovh.net.) which marks them as fully-qualified. Some external DNS panels need that dot and some add it for you — don't accidentally turn the target into …ovh.net.yourdomain.com.
- DNS setup
Cloudflare proxy breaks DKIM. If your DNS is on Cloudflare, the two DKIM selector CNAMEs must be set to "DNS only" (grey cloud). An orange-cloud proxied CNAME won't resolve to dkim.mail.ovh.net and the badge stays red.
- Coverage
~all vs -all. OVH's SPF wizard lets you pick the failure policy; -all (hard fail) is the strongest anti-spoofing and the right end state, but only switch from ~all to -all once you're certain every legitimate source that sends as your domain is in the SPF record — otherwise -all can bounce your own mail.
Build your SPF record
OVHcloud is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listOVHcloud SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.