Log in

STRATO: set up SPF, DKIM and DMARC step by step

5 min read · updated 1 Nov 2026 · Timo Kessel

If your domain is with STRATO, you set up SPF, DKIM and DMARC in the customer login under the DNS settings. Here is where to find the records, which values STRATO itself names and how to check the result. As of 1 November 2026.

STRATO's interface changes from time to time. The information comes from STRATO's help (managing DNS records yourself, TXT record, both in German), retrieved on 1 November 2026. If anything differs, check STRATO's current help.

First: who manages the DNS?

If you use the STRATO name servers (the normal case), you create all records at STRATO. If you have entered your own name servers but still use STRATO for email, you must maintain records such as DKIM where your DNS lives. The MX tool and the domain check show what is in DNS today.

Opening the DNS settings at STRATO

  1. Log in to the STRATO customer login.
  2. Go to Domains and then Domain management (“Domainverwaltung”).
  3. Click the gear icon next to the domain and open the DNS tab.

There you create TXT records: a TXT record stores any text in the DNS zone, as STRATO's help puts it. According to STRATO, changes can take up to 24 hours to apply everywhere. Usually it is minutes.

SPF

For SPF you create exactly one TXT record. If only STRATO's mail servers send for your domain, STRATO names this value:

v=spf1 redirect=_spf.strato.com

If other services also send in your name (newsletter tool, invoicing program), the record must be extended. STRATO describes this in the “SPF” section of the article on the TXT record. Important: a domain may have only one SPF record, two records cause an error (fixing SPF PermError). The SPF generator builds the right record for you.

DKIM

At STRATO the mail server signs with keys that are published through CNAME records. STRATO's help shows records such as strato-dkim-0002._domainkey pointing to strato-dkim-0002._domainkey.rzone.de. STRATO points out that the keys are rotated at intervals, so the selector number may be a different one. Take the current values from STRATO's help or from your account, not from an example.

If you use the STRATO name servers, STRATO maintains these records itself according to its help. With your own name servers you must create them there yourself. Whether the records arrive is shown by the DKIM checker: it looks for the common selectors, and you can enter your own.

DMARC

Create a TXT record named _dmarc. Start with p=none so nothing changes for your emails and you receive reports:

v=DMARC1; p=none; rua=mailto:reports@your-domain.com

The DMARC generator builds the finished record. If you do not want to read the reports yourself, create a free account: Postwacht analyzes them and tells you step by step when quarantine and later reject are safe (analyzing DMARC reports).

Checking

  1. Wait until the records are visible (usually minutes, 24 hours at most).
  2. Check everything at once with the domain check.
  3. Send an email to a test address in the email test. It shows whether SPF and DKIM pass and align on a real email.

Frequently asked questions

I already have an SPF record from STRATO. Do I need to do anything?

Only if other services send in your name. Then the record must be extended instead of creating a second one.

Why does the checker not show my DKIM key?

Either the record is not active yet, or the selector is not one of the common ones. Enter it in the DKIM checker. You will find it in the header of a sent email (finding your DKIM selector).

Is the information still correct?

It comes from STRATO's help of 1 November 2026. If you notice anything different, write to us via support.

Read more