Log in

Hetzner: set up SPF, DKIM and DMARC step by step

5 min read · updated 1 Nov 2026 · Timo Kessel

If the DNS of your domain is at Hetzner, you create SPF, DKIM and DMARC in the DNS management of the Hetzner Console. Here is where to find them and what to watch for. As of 1 November 2026.

Hetzner's interface changes from time to time. The information comes from Hetzner's help (adding records, TXT records), retrieved on 1 November 2026. Hetzner describes the fields for TXT records in a separate article. Look there before you save.

First: who sends your email?

Hetzner is only the place where the records live, provided you use the Hetzner name servers. The SPF value and the DKIM records are named by the service you send email through (your mail server, Google Workspace, Microsoft 365, a newsletter tool). Get them there. Guides: Google Workspace and Microsoft 365. The domain check shows what is in DNS today.

Creating records at Hetzner

  1. In the Hetzner Console open your project and choose DNS on the left.
  2. Choose the zone (domain) you want to change.
  3. Open the list under Type and choose the record type (TXT for SPF and DMARC).
  4. Fill in all required fields and click Add.

Which details a TXT record needs is in Hetzner's article on TXT records. You will also find there how to enter long values.

SPF

Create exactly one TXT record for the domain that starts with v=spf1 and names all services that send in your name. Two SPF records cause an error (fixing SPF PermError). The SPF generator builds the right record.

DKIM

If you run your own mail server (Postfix, Mailcow, Mail-in-a-Box), the DKIM generator creates a key pair: you create the public part as TXT record selector._domainkey at Hetzner and put the private part on the server. If you use a service, take its values (CNAME or TXT). Whether everything arrives is shown by the DKIM checker.

DMARC

Create a TXT record named _dmarc. Start with p=none so nothing changes for your emails and you receive reports:

v=DMARC1; p=none; rua=mailto:reports@your-domain.com

The DMARC generator builds the finished record. With a free account Postwacht analyzes the reports and tells you when quarantine and later reject are safe (analyzing DMARC reports).

Checking

  1. Wait until the records are visible. It is better to change SPF, DKIM and DMARC one after the other.
  2. Check everything at once with the domain check.
  3. Send an email to a test address in the email test. It shows whether SPF and DKIM pass and align on a real email.

Frequently asked questions

What about the reverse DNS record of my server?

It belongs to the IP address, not the domain, and is set with the provider of the IP, for Hetzner servers in the server management. The reverse DNS check shows whether it is right (reverse DNS for mail servers).

Can I send email from a Hetzner server?

That depends on the offering and on the provider's rules for port 25. Check them with Hetzner beforehand. With the SMTP test you can see whether your server is reachable from outside.

Is the information still correct?

It comes from Hetzner's help of 1 November 2026. If you notice anything different, write to us via support.

Read more