DNS help › IONOS

How to add SPF, DKIM and DMARC records in IONOS

IONOS (formerly 1&1) hosts domains, websites and email for lots of UK small businesses. If your domain is with IONOS and uses its default nameservers, you add your email security records in the IONOS DNS settings.

This guide shows where to find your DNS settings, how to add or change a record, and what the main email records do.

Before you start

Records only take effect if your domain uses the IONOS nameservers. If you've pointed it somewhere else, add the records with that provider instead.

Step 1: Log in and find your DNS settings

1. Log in to IONOS.
2. Go to Domains & SSL.
3. Next to the domain you want, open the Actions menu and select DNS. (IONOS shows this as a gear icon or a three-dot menu, depending on your account view.)

Step 2: Add a TXT record

1. Click Add Record and choose TXT.
2. In Host name, enter the host (use @ for the domain itself).
3. In Value, paste the record text.
4. Leave the TTL as it is unless you have a reason to change it.
5. Click Save.

About the Name field: Use @ for the domain itself, or just the prefix (for example _dmarc) for anything else.

Changing an existing record

To edit a TXT record, open the DNS settings as above, then use the edit option next to that record (a gear menu with Edit record, or a pencil icon). Change the value and click Save.

Adding a CNAME record

For a CNAME record (Microsoft 365 uses these for DKIM), click Add Record and choose CNAME instead of TXT.

The same steps work for the Tidy Cyber ownership record: Name _tidycyber-verify, with the code we show you when you verify. The code is unique to you and your domain.

Step 3: Understand your email records

These are the records our check looks at. If one already exists, it usually needs editing rather than adding another.

SPF: say who can send email for you

SPF is a single TXT record on your domain that lists the services allowed to send email as you, such as your email provider, newsletter tool or invoicing system. Without it, it's much easier for a scammer to send email that looks like it came from you.

A domain can only have one SPF record, so if you already have one, it needs editing rather than adding a second. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DMARC: tell the world what to do with fakes

DMARC is a TXT record that tells other mail servers what to do with email that fails the SPF and DKIM checks, and can send you reports about who is sending email using your name.

It's best introduced gently: first just watching, then gradually asking receivers to junk and then refuse fake email, once you're sure your genuine email passes. Our free check flags a watch-only policy as a high risk, because fakes are still delivered. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DKIM: sign your emails

DKIM adds a digital signature to the email you send, so receivers can tell it really came from you and wasn't changed on the way. Your email provider creates the key and you publish it in your DNS, as a TXT record or as CNAME records depending on the provider. You can't make up a DKIM value yourself.

In Google Workspace, DKIM lives in the Google Admin console under Gmail's Authenticate email settings. In Microsoft 365, it's on the DKIM tab of the Email authentication settings in the Microsoft Defender portal (see our Microsoft 365 guide). Newsletter tools and booking systems usually have their own DKIM settings. For a CNAME record (Microsoft 365 uses these for DKIM), click Add Record and choose CNAME instead of TXT.

The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

Domains that don't send email

Spare and old domains you never email from can still be used to fake email in your name, so they need locking down too, in a slightly different way from a domain you do use. The full report checks for this and gives the exact records for that domain.

Optional: DNSSEC

DNSSEC adds tamper protection to your DNS records. Our check reports it as a low-priority item. IONOS offers DNSSEC with its DNS Pro or Domain Guard features, for domains using the default IONOS nameservers. Whether it applies to your domain depends on your provider and domain ending; the full report tells you.

Check it worked

IONOS says changes are live on its side straight away, and usually show up elsewhere within an hour. Once you think the change has gone through:

1. Go to the free Tidy Cyber check and enter your domain.
2. Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
3. If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.

The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.

Official IONOS help

We checked these steps against the official guides in October 2026. Screens do change, so if something looks different, follow the provider's own guide:

• Managing TXT records
• Setting up and managing DNSSEC

← All DNS guides