How do I add SPF, DKIM and DMARC records in Hostinger?

In Hostinger, you add SPF, DKIM and DMARC in your domain's DNS records: open Domains in the Hostinger dashboard, choose DNS, select your domain and add TXT records for SPF and DMARC and CNAME or TXT records for DKIM. If you use Microsoft 365 or Google Workspace rather than Hostinger Email, replace Hostinger's default email records instead of adding a second set.

SPF lists the services allowed to send your email. DKIM adds a digital signature that proves an email came from your domain. DMARC tells receivers what to do when an email fails both, and sends you reports. Without them, Outlook, Microsoft 365 and Gmail can't confirm your email is genuine, so more of it lands in junk.

Step 1: Check Hostinger runs your DNS

Records in Hostinger only work if your domain uses Hostinger's nameservers (the servers that tell the internet where your DNS lives). Look up your domain with any WHOIS tool. Hostinger says nameservers in the dns-parking.com format, such as ns1.dns-parking.com, mean Hostinger manages your DNS.

One trap: Hostinger lets you edit a domain's records even when its nameservers point somewhere else. The changes are saved, but they only take effect if you switch the nameservers back to Hostinger. If your nameservers belong to another company, add the records there.

Step 2: Work out which records you need

The records depend on who sends your email, not on who hosts your website.

Hostinger Email. If your nameservers are Hostinger's, the simplest route is automatic. Go to Emails, select Mailboxes next to your domain, then Domain settings, and use Connect automatically. Hostinger checks each record and adds what's missing. Whichever DMARC record you use, make sure its report address is a mailbox you read.

Microsoft 365 or Google Workspace. Your zone may still hold Hostinger Email's records from when the domain was set up. Hostinger's guide for other email services says to remove existing MX, SPF, DKIM and DMARC records that point to another email service, because conflicting records cause delivery problems. Replace them rather than adding a second set.

Step 3: Open the DNS editor

1. In the Hostinger dashboard, choose Domains in the left sidebar, then DNS.
2. Select your domain. You land on the DNS records tab of DNS / Nameservers.

Hostinger has moved this menu recently. If you don't see DNS in the sidebar, open Domains, select Manage next to your domain, then DNS / Nameservers.

To add a record, choose the Type, fill in Name, the value (Hostinger's help calls it TXT value for TXT records and Target or Points to for CNAMEs) and TTL, then select Add Record. Your existing records are listed underneath, with a search bar.

For Name, enter @ for yourbusiness.com.au itself. For everything else, enter only the part before your domain; Hostinger adds the domain automatically. For TTL (how long other servers remember the record), Hostinger's default is 14400 seconds, which is four hours.

Step 4: Add or update your SPF record

1. Search your records for a TXT record on @ that starts with v=spf1.
2. If you find one, edit it. A domain can only have one SPF record, and two break SPF completely.
3. If there's none, add a TXT record with Name @ and your SPF value from the table.

If more than one service sends as you, combine them in one line, as Hostinger's own guide shows. For example, if your website still sends through Hostinger Email while your staff use Microsoft 365:

v=spf1 include:spf.protection.outlook.com include:_spf.mail.hostinger.com ~all

Keep the total under 10 DNS lookups.

Step 5: Add your DKIM records

Microsoft 365 gives you two CNAME records in the Defender portal, under Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. For each one, add a CNAME record with Name selector1._domainkey (then selector2._domainkey) and paste Microsoft's value into Target. It ends in either .onmicrosoft.com or .dkim.mail.microsoft. Then switch on DKIM signing in the Defender portal. Our guide to setting up DKIM in Microsoft 365 covers that part.

Google Workspace generates a key in the Google Admin console under Apps → Google Workspace → Gmail → Authenticate email. Add it as a TXT record with Name google._domainkey, then select Start authentication in Google. Copy every key exactly; one missing character breaks it.

Step 6: Add a DMARC record

1. Search for an existing TXT record named _dmarc. If there's one, edit it rather than adding another.
2. Otherwise add a TXT record with Name _dmarc and this value:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com.au

p=none is monitoring mode, so nothing changes for your email yet. The rua address is where receivers send daily reports about who is sending as you. Once they show all your genuine email passing, change p=none to p=quarantine.

Step 7: Check it worked

Hostinger says to allow up to 24 hours. Once the records have had time, send an email to your free test address. The report checks SPF, DKIM, DMARC and alignment (whether those checks passed for your own domain), gives a verdict for Gmail, Google Workspace, Outlook.com, Microsoft 365 and Yahoo, and shows the exact record to change if anything is still wrong.

Checked against: Hostinger Help, How to manage DNS records at Hostinger · Hostinger Help, How to manage TXT records at Hostinger · Hostinger Help, How to manage CNAME records at Hostinger · Hostinger Help, How to look up domain nameservers at Hostinger · Hostinger Help, Set up a domain for Hostinger Mail manually · Hostinger Help, What is the SPF record for Hostinger Email? · Hostinger Help, How to set up a domain for Google Workspace Email · Hostinger Documentation, Email Domain Settings · Google Workspace Admin Help, Set up DKIM · Microsoft Learn, How to use DKIM for email in your custom domain.