Postmark: DKIM and SPF setup

Before you start

In Postmark, domains live on the Sender Signatures page. You need access to the DNS settings of example.com. Postmark's pages do not name a Postmark role or plan for the setup.

Postmark says adding its DKIM and Return-Path records does not affect your other DNS records, or mail you send from example.com through other services.

Turn on DKIM

Postmark asks for one TXT record for DKIM. Verifying it also verifies the whole domain for sending.

1. Go to the Sender Signatures page.
2. Under example.com, select DNS Settings or Add a DKIM DNS record.
3. Postmark shows a DKIM record to add as a TXT record.
4. At your DNS host, add a TXT record with the Hostname and Value shown on the DNS Settings page.

Postmark shows DKIM as verified within 48 hours. Click Verify to check sooner. Once the record is verified, Postmark signs mail it sends from example.com with DKIM, using a 1024-bit key. The Postmark pages this guide is written from do not give the record's name pattern, so copy it from Postmark.

Sign with your own domain

Postmark signs with example.com only after its DKIM record is verified. Postmark says passing DKIM for your domain needs a verified domain. Add the record as in Turn on DKIM.

Use your own bounce domain

Postmark calls this a custom Return-Path. By default the Return-Path of Postmark mail is pm_bounces@pm.mtasv.net. SPF passes for pm.mtasv.net but does not align with example.com.

1. At your DNS host, add a CNAME record for pm-bounces.example.com with the value pm.mtasv.net.
2. In Postmark, choose Signatures and select the DNS Settings link on example.com.
3. In the Return-Path section, enter the name you used in the CNAME record.

The Return-Path then becomes pm_bounces@pm-bounces.example.com, and SPF aligns. pm-bounces is Postmark's default name. You may choose another, but use the name Postmark shows. Postmark's verification page writes the default hostname as pm_bounces with an underscore, while its Return-Path and troubleshooting pages use pm-bounces.

Postmark says the Return-Path must be a subdomain of example.com. SPF then aligns only with relaxed alignment, so your DMARC record needs aspf=r or no aspf at all.

SPF

Postmark says you no longer need to add Postmark to the SPF record of example.com. The Return-Path domain is what receivers check for SPF, and it is Postmark's own domain until you set a custom one.

You can add include:spf.mtasv.net to the SPF record of example.com, but Postmark says it does nothing for alignment, because example.com is not the Return-Path domain. For aligned SPF, use the custom Return-Path above. That CNAME already carries Postmark's SPF record, and a name cannot have a CNAME and an SPF TXT record at the same time.

Check it worked

1. On the DNS Settings page for example.com, DKIM and Return-Path show as verified. Postmark says this can take up to 48 hours. Click Verify to check sooner.
2. If the Return-Path does not verify, look up pm-bounces.example.com as a CNAME. It should return pm.mtasv.net. If your DNS host appended example.com to the value, as in pm.mtasv.net.example.com, enter the value with a trailing dot: pm.mtasv.net.. On Cloudflare, turn the proxy off for this record.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM and SPF align for Postmark.

Postmark's help article on using your own domain for link tracking returned "page not found" on 2026-09-26, so this guide does not describe that setting.

Postmark's pages: How do I verify a domain?, How do I add a custom return-path?, My Return-Path record won't verify and How do I set up SPF for Postmark?.