DMARC for email delivery services
How do I set up DMARC for Postmark?
Postmark uses a DKIM TXT record and a custom Return-Path CNAME. You do not add Postmark to your own SPF record: Postmark says that does nothing.
The DNS records for Postmark
SPF: Not needed on your root domain
No SPF value to copy for this platformPostmark says it is no longer required to include it in your SPF record, and that spf.mtasv.net there would do nothing. The custom Return-Path handles SPF.
DKIM selector: A timestamp followed by pm, shown in DNS Settings
<timestamp>.pm._domainkey.example.com TXT (value from DNS Settings)Postmark's example is 20130425164621.pm._domainkey.postmarkapp.com. The selector is everything before ._domainkey.
Custom Return-Path
pm_bounces CNAME pm.mtasv.netValues in angle brackets are specific to your account. Copy the real ones from Postmark rather than from this page.
Alignment caveats
- ✓Without a custom Return-Path, the Return-Path is on pm.mtasv.net, so SPF fails alignment. DKIM can still carry DMARC.
- ✓The custom Return-Path is a subdomain of your From domain, so do not publish aspf=s, which would stop SPF aligning.
- ✓Some DNS providers append your domain, which doubles it in the host name. Enter only the part before your domain.
From p=none to p=reject with Postmark
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Verify both DKIM and the Return-Path in Postmark, so mail has two aligned results before you move to p=reject.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from Postmark's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how Postmark really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does Postmark need?
Not needed on your root domain. Postmark says it is no longer required to include it in your SPF record, and that spf.mtasv.net there would do nothing. The custom Return-Path handles SPF.
What DKIM selector does Postmark use?
A timestamp followed by pm, shown in DNS Settings. Postmark's example is 20130425164621.pm._domainkey.postmarkapp.com. The selector is everything before ._domainkey.
Will Postmark mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Without a custom Return-Path, the Return-Path is on pm.mtasv.net, so SPF fails alignment. DKIM can still carry DMARC.
How do I reach p=reject with Postmark?
Start at p=none with a rua address, finish the Postmark setup, then read your reports. Verify both DKIM and the Return-Path in Postmark, so mail has two aligned results before you move to p=reject. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
