SPF, DKIM and DMARC for Postmark

Short answer: Postmark mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Step by step

1. In Postmark open Sender Signatures, add your domain and click DNS Settings.
2. Add the DKIM TXT record with exactly the host name and value shown there.
3. Add the Return-Path CNAME: the host name shown (by default something like pm-bounces) pointing to pm.mtasv.net.
4. Click Verify for each, or wait: Postmark checks again for up to 48 hours.
5. Publish DMARC with p=none at _dmarc to start monitoring.

Mistakes that break it

• Some DNS panels append your domain to the CNAME target (pm.mtasv.net.yourdomain.com). Adding a trailing dot (pm.mtasv.net.) prevents it.
• On Cloudflare, turn the proxy off for the Return-Path CNAME, or Postmark can't verify it.
• Without the custom Return-Path, Postmark mail still passes DMARC through DKIM, but not through SPF alignment.

Check that it worked

After the fix, keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Other setup guides

Google Workspace · Microsoft 365 · Zoho Mail · Hostinger Email · Titan Email · GoDaddy email (Microsoft 365 and Professional Email) · Proton Mail · Cloudflare Email Routing · Mailchimp · SendGrid · Amazon SES · Shopify Email · Klaviyo · HubSpot · Brevo · Mailgun · Zendesk · Constant Contact · MailerLite · Kit (ConvertKit)