Configure SPF, DKIM and DMARC at OVHcloud

To configure DMARC at OVHcloud, open the domain DNS zone, add a DMARC or TXT record at _dmarc, and start with p=none. This first step does not request quarantine or rejection: it lets you collect reports before enforcing protection.

1. Check SPF and DKIM before DMARC

DMARC relies on SPF, DKIM and alignment between their authenticated domains and the domain shown in the From address. List every source that sends mail for your domain: OVHcloud email, forms, billing tools and marketing platforms.

Keep only one SPF record for each name. A standard OVHcloud email configuration may include:

v=spf1 include:mx.ovh.com ~all

The exact value depends on your plan and all authorized senders. For DKIM, use the selector and public key supplied by each sending service.

2. Add the DMARC record in OVHcloud

1. Sign in to the OVHcloud Control Panel.
2. Open Web Cloud, choose the domain, then open DNS zone.
3. Select Add an entry.
4. Choose DMARC, or TXT to enter every tag yourself.
5. Enter only _dmarc in the subdomain field for the root domain.
6. Add the monitoring policy below and confirm.

3. Start with a monitoring policy

Create a mailbox for reports, then replace the example address:

v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r; pct=100

• v=DMARC1 sets the protocol version;
• p=none observes mail without blocking it;
• rua receives aggregate reports;
• adkim=r and aspf=r use relaxed alignment;
• pct=100 applies the monitoring policy to all traffic.

Do not add quotation marks in the OVHcloud form. The complete published name is _dmarc.example.com.

4. Read reports before enforcing

Aggregate reports usually arrive as XML files. They show observed sending sources and SPF, DKIM and DMARC results; they are not full copies of message content.

Confirm that every legitimate source has at least one valid, aligned SPF or DKIM result. Fix forgotten forms, applications and third-party services before applying a stricter policy.

5. Move gradually to quarantine and reject

After several weeks of observation covering normal traffic, test p=quarantine on a limited percentage with pct. Increase it gradually after checking reports. Use p=reject only when every legitimate sender is identified and aligned.

6. Test a real message

Send a message to an external mailbox, open its complete headers and look for spf=pass, dkim=pass and dmarc=pass. A real-message test complements the DNS audit by checking the actual sending path.

7. Fix common DMARC mistakes

• Two DMARC records: keep one policy at _dmarc.
• Full host name entered as subdomain: if OVHcloud adds the domain, enter only _dmarc.
• Missing rua mailbox: create and monitor it before publishing.
• SPF passes but is not aligned: check the return-path domain used by the sender.
• Policy enforced too early: return to monitoring, fix legitimate sources, then proceed gradually.

Frequently asked questions about DMARC at OVHcloud

What name should I enter?

Enter _dmarc in the subdomain field. The complete name becomes _dmarc.example.com.

Which policy should I use first?

Start with p=none and enforce only after reviewing reports.

Why can DMARC fail when SPF passes?

DMARC also checks alignment between the authenticated domain and the domain visible in the From address.

How do I verify publication?

Query _dmarc.example.com, then send a real message and inspect its headers.

References: DMARC specification and OVHcloud DNS documentation. Interfaces and offers may change, so always preserve the exact values supplied by your email providers.

Published July 19, 2026 · updated August 21, 2026.