Postmark by ActiveCampaign delivers transactional emails with high deliverability. This guide covers the complete email authentication stack for Postmark: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.
Authorize Postmark to send transactional email on behalf of your domain by adding the correct SPF include.
TXT
@
v=spf1 include:spf.mtasv.net ~all
Add include:spf.mtasv.net to your existing SPF record. mtasv.net is Postmark's mail infrastructure domain.
Go to account.postmarkapp.com and sign in.
Navigate to Sender Signatures or Domains. Add your domain and Postmark will display the required DNS records.
Look up your current SPF record.
dig TXT yourdomain.com +short | grep spfAdd include:spf.mtasv.net to your existing SPF record.
v=spf1 include:spf.mtasv.net ~allClick "Verify" in Postmark. The platform will confirm your DNS records are correct.
v=spf1 include:_spf.google.com ~allv=spf1 include:_spf.google.com include:spf.mtasv.net ~allAdd include:spf.mtasv.net to your SPF record. For example: v=spf1 include:spf.mtasv.net ~all.
spf.mtasv.net is Postmark's SPF include domain. MTASV stands for Message Transfer Agent Service, which is Postmark's sending infrastructure.
Yes. Postmark allows you to set a custom Return-Path domain (bounce domain), which helps achieve SPF alignment for DMARC.
Publish a DKIM TXT record provided by Postmark to enable cryptographic signing of your transactional email.
TXT
20xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx._domainkey
v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY_FROM_POSTMARK
Postmark generates a unique DKIM selector and key for each domain. Copy the exact values from your Postmark dashboard.
Go to account.postmarkapp.com and sign in.
Go to your domain under Sender Signatures or Domains. Postmark displays the DKIM record details.
Postmark provides a TXT record with a unique selector (a long alphanumeric string) and the public key value.
Create the TXT record in your DNS provider using the selector and value from Postmark.
20xxxxxxxx._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GC..."Click "Verify" in Postmark. Once DNS propagates, Postmark will confirm DKIM is active.
Postmark generates a unique alphanumeric selector for each domain. It is a long string like 20xxxxxxxxxx. Check your Postmark dashboard for the exact selector.
Postmark uses a TXT record for DKIM, containing the public key directly in the DNS record value.
Yes. Postmark supports DKIM key rotation. Generate a new key, publish the new TXT record, verify it, then remove the old record.
Publish a DMARC record to protect your domain when sending transactional email through Postmark.
TXT
_dmarc
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
Postmark also offers a free DMARC monitoring tool at dmarc.postmarkapp.com.
Verify both SPF (include:spf.mtasv.net) and DKIM are set up and passing for your Postmark domain.
Configure a custom Return-Path (bounce) domain in Postmark for SPF alignment. This is optional but recommended.
Add a TXT record at _dmarc.yourdomain.com.
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1Postmark offers a free DMARC monitoring tool at dmarc.postmarkapp.com. You can use their rua address for easy report analysis.
Move from p=none to p=quarantine to p=reject after confirming all senders pass.
Yes. Postmark provides a free DMARC monitoring tool at dmarc.postmarkapp.com that parses and visualizes your aggregate reports.
Yes. Postmark provides DKIM alignment automatically. For SPF alignment, configure a custom Return-Path (bounce) domain.
Yes. Postmark's DMARC tool provides an rua address you can use. Add it alongside your own reporting address for visual report analysis.
Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.