Set up SPF, DKIM and DMARC on OVHcloud

The DNS records that make receivers trust mail from your OVHcloud MX Plan — publish the SPF, switch DKIM on in the Control Panel, add DMARC, then confirm it landed.

Check your setup free → OVHcloud docs ↗

Before you start

What OVHcloud needs from your DNS.

OVHcloud carries your mail, but Gmail, Outlook and every other receiver judge it on what your DNS says, not on the fact that OVHcloud sent it. SPF authorises OVHcloud's mail servers to send for your domain, DKIM signs each message so tampering shows, and DMARC ties both to the domain your recipients see and tells receivers what to do when a message fails.

None of this is on by default. DKIM in particular has to be switched on from the OVHcloud Control Panel: on the MX Plan you click the DKIM badge and validate, and OVHcloud publishes two CNAME records into the DNS zone for you. If your domain's DNS is hosted elsewhere, you copy those two CNAMEs across by hand before enabling. Until DKIM is active, every message you send is unsigned.

Since February 2024, Gmail and Yahoo require anyone sending in bulk to publish SPF, DKIM and a DMARC record. On OVHcloud, authenticating is no longer optional housekeeping — it is the gate to your own recipients' inboxes.

The records to publish

Copy these into your DNS.

Add each record at your DNS provider — the company where your domain is registered, not OVHcloud. Then run the checker to confirm every one resolves.

SPF record

host @ type TXT

v=spf1 include:mx.ovh.com ~all

One SPF record only. If other services send for you — a CRM, a newsletter tool — add their include: to this same line rather than publishing a second SPF record, which is an error that voids both.

DKIM (selector 1) record

host ovhmoXXXXXXX-selector1._domainkey type CNAME

value generated by OVHcloud

Enable DKIM from the Control Panel (Web Cloud → MX Plan → your domain → General information → the DKIM badge → Validate). OVHcloud generates a unique selector for your domain — ovhmoXXXXXXX-selector1 is the pattern, not a literal value. When your DNS is at OVHcloud the CNAME is created for you; when it is hosted elsewhere, copy the exact host and target OVHcloud shows you, e.g. a target ending in ._domainkey.NNNNNN.aj.dkim.mail.ovh.net.

DKIM (selector 2) record

host ovhmoXXXXXXX-selector2._domainkey type CNAME

value generated by OVHcloud

The second CNAME exists so OVHcloud can rotate keys without breaking signing. Publish both selectors — DKIM is not considered configured until each resolves. Take the exact host and target from the activation window; do not guess the digits.

DMARC record

host _dmarc type TXT

v=DMARC1; p=none; rua=mailto:[email protected]

Start at p=none to watch who sends as you, then raise to quarantine and reject once your reports show every legitimate sender aligning. Point rua at an address you actually read.

Step by step

The whole setup, in order.

1 Publish SPF in your DNS zone. In the OVHcloud Control Panel under Web Cloud → Domain names → your domain → DNS zone (or at your external DNS host), add the TXT record above at the root of your domain. If an SPF record already exists, edit it to include mx.ovh.com rather than adding a second one.
2 Enable DKIM in the Control Panel. Go to Web Cloud → MX Plan, select your domain, open the General information tab, click the red DKIM badge and choose Validate. OVHcloud generates two selectors (ovhmoXXXXXXX-selector1 and -selector2) unique to your domain.
3 Publish the two DKIM CNAMEs. If your DNS zone is at OVHcloud, the two CNAME records are added automatically. If your domain uses external DNS — Cloudflare, your registrar — the activation window shows two CNAME host and target pairs; copy each exactly into your DNS, let them propagate, then click Enable.
4 Publish DMARC. Add the _dmarc TXT record above. Begin at p=none so you break nothing while you read the reports, and keep the rua address pointed somewhere you will see it.
5 Wait, then verify. OVHcloud can take from 30 minutes up to 24 hours to activate DKIM, and DNS changes can take up to 24 hours more to propagate. Once the DKIM badge turns green, run a full check here to confirm SPF resolves under the 10-lookup limit, both selectors are found, and DMARC is graded.

Where it goes wrong

The mistakes specific to OVHcloud.

DKIM badge validated but CNAMEs never published On external DNS, clicking Validate only shows you the two CNAME values — it does not publish them. You must add both to your DNS zone yourself and wait for them to resolve before OVHcloud will sign your mail.

Guessing the selector digits The ovhmoXXXXXXX selectors are unique per domain. Copy the exact host and target from the activation window; a selector or target with the wrong digits will never resolve and DKIM stays broken.

A second SPF record Adding v=spf1 include:mx.ovh.com as a new record alongside an existing one is a permerror. Merge every sender into a single SPF line.

DKIM published as TXT OVHcloud DKIM is delegated with CNAME records, not a TXT value you paste. Publishing a TXT at the selector name will not work — use the CNAME type.

SPF on the wrong name The record belongs at the root of the domain you send from, not on a www or mail subdomain.

Impatience Testing DKIM minutes after enabling shows a failure that is only propagation. OVHcloud allows up to 24 hours for activation — give it time before concluding anything is wrong.

Confirm it worked

Do not trust it until you have checked it.

DNS takes a few minutes to propagate. Once it has, run a full check: it reads all three records live, counts your SPF lookups, confirms the OVHcloud DKIM selector resolves, and grades your DMARC policy — the exact things that decide whether Gmail and Outlook trust your mail.

Check your domain → Or send a test email

Common questions

About OVHcloud, specifically.

What is the SPF record for OVHcloud? v=spf1 include:mx.ovh.com ~all, published as a TXT record at the root of your domain. This covers MX Plan, Email Pro and Hosted Exchange. If other services also send for you, add their include: to the same record — never publish two.

What is the OVHcloud DKIM selector? OVHcloud generates two per-domain selectors in the format ovhmoXXXXXXX-selector1 and ovhmoXXXXXXX-selector2, each published as a CNAME under _domainkey. You do not choose the value: enable DKIM from the Control Panel and copy the exact CNAME host and target it shows you.

Why is my OVHcloud DKIM failing? Almost always one of three things: you validated DKIM in the Control Panel but never published the two CNAMEs in an external DNS zone; you published them as TXT instead of CNAME; or you are checking before propagation. OVHcloud can take up to 24 hours to activate DKIM.

How do I enable DKIM on the OVHcloud MX Plan? In the Control Panel go to Web Cloud → MX Plan, select your domain, open the General information tab, click the red DKIM badge and choose Validate. If your DNS is at OVHcloud the CNAMEs are added for you; if not, publish the two CNAMEs shown before clicking Enable.

Do I need DMARC for OVHcloud email? Yes if you send in bulk to Gmail or Yahoo — both have required it since February 2024. Publish a _dmarc TXT record starting at p=none with a report address, then move to quarantine and reject once your reports show every legitimate sender aligning.

Where do I add these records — in OVHcloud or at my registrar? In whichever DNS zone controls your domain. If your domain is at OVHcloud, use the DNS zone in the Control Panel. If it is hosted elsewhere, such as Cloudflare, publish the SPF, DKIM CNAMEs and DMARC there instead.

Set it once. Know it stays set.

A DKIM key rotates, a vendor changes its SPF, an IP gets listed — and your carefully-configured domain quietly breaks. Monitoring watches all of it and tells you the day it changes.

Check your domain free → See monitoring