Set up SPF, DKIM and DMARC in Plesk for better email delivery

Gmail, Outlook and Yahoo now expect mail to be authenticated. Without SPF, DKIM and DMARC your messages are far more likely to land in spam or be rejected. Plesk can create all three records and sign outgoing mail automatically – you only need to turn the options on and check the DNS.

Before you start

• Mail for the domain is sent from the Plesk server.
• Know where your DNS is hosted. If it is not on the Plesk server, you must copy the records to your DNS provider.

What each record does

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a cryptographic signature that receivers verify with a public key in DNS.
• DMARC tells receivers what to do when SPF or DKIM fails and where to send reports.

Enable DKIM signing

1. Administrators: go to Tools & Settings → Mail Server Settings and tick Allow signing outgoing mail under DKIM spam protection. Also tick Verify incoming mail. Click OK.
2. For each domain: go to Mail → Mail Settings, click the domain and tick Use DKIM spam protection system to sign outgoing email messages.
3. Click OK. If Plesk manages DNS, it adds the default._domainkey TXT record automatically.

Review the SPF record

Open Hosting & DNS → DNS for the domain and find the TXT record for the root domain starting with v=spf1. A typical value is:

v=spf1 +a +mx +a:mail.example.com -all

• Add any other services that send for you, for example include:_spf.google.com or your newsletter provider.
• Use only one SPF record per domain; merge mechanisms into it.
• Use ~all (soft fail) while testing, and -all once you are sure every sender is listed.

Add a DMARC record

Plesk creates a basic _dmarc TXT record from its template. Edit it or add one with:

v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1

Start with p=none to collect reports without affecting delivery. After a few weeks, when reports show your mail passes, move to p=quarantine and later p=reject.

External DNS (Cloudflare, registrar)

1. In Plesk open Hosting & DNS → DNS and copy the value of default._domainkey.
2. At your DNS provider create a TXT record named default._domainkey with that value.
3. Create or update the SPF and _dmarc TXT records the same way.

Verify

• Send a message to a Gmail address, open it, choose Show original and check that SPF, DKIM and DMARC show PASS.
• Or query DNS: dig TXT default._domainkey.example.com.

Troubleshooting

• DKIM fails: the public key in DNS does not match, often because a record was truncated at the DNS provider. Paste it again as one value.
• SPF permerror: two SPF records or more than 10 DNS lookups. Merge or simplify includes.
• DMARC fails while SPF passes: the From domain does not align, for example mail sent by a third-party service with its own domain. Configure DKIM at that service for your domain.
• Still in spam: also set a matching reverse DNS (PTR) for the server IP; on VPS servers see set rDNS in Virtualizor.

Next steps

• Manage DNS records in Plesk.
• Configure the spam filter.
• Compare with cPanel email authentication.