Postmark needs two DNS records per sending domain: a DKIM TXT record at a timestamped selector such as 20130425164621.pm._domainkey, and a CNAME from pm-bounces to pm.mtasv.net for the custom Return-Path. You do not add anything to your root SPF record. With both verified, Postmark mail aligns on DKIM and SPF, and Postmark says each verifies within 48 hours.
The records at a glance
| Type | Host | Value |
|---|---|---|
| TXT | <timestamp>.pm._domainkey |
k=rsa; p=... (from Postmark) |
| CNAME | pm-bounces |
pm.mtasv.net |
| TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:dmarc@example.com |
Postmark calls DKIM, a custom Return-Path and DMARC together its "magic trifecta". The first two are set up in Postmark. DMARC is your own record.
Where to do it in Postmark
- Sign in to Postmark and open the Sender Signatures tab.
- Next to your domain, click DNS Settings (or Add a DKIM DNS record).
- Copy the DKIM host name and value into a new TXT record at your DNS host.
- On the same page, copy the Return-Path host name and value into a new CNAME record.
- Click Verify next to each one, or wait for Postmark to check on its own.
Postmark says each record shows as verified "within 48 hours" and that DNS changes can take several hours. Its verification guide adds that these records do not affect any other DNS records or mail you send through other services.
DKIM: a 1024-bit TXT key
Postmark's DKIM article says it signs with 1024-bit keys. The record is a plain TXT record, not a CNAME, so the key sits in your DNS. A 1024-bit key fits inside one 255-character string, so you will not need to split it.
The selector is a timestamp followed by .pm. Postmark's own example is 20130425164621.pm, giving a full record name of 20130425164621.pm._domainkey.example.com. Yours will have a different timestamp. Use the one on your DNS Settings page.
The duplicated-domain mistake
Postmark's DKIM troubleshooting names this as a common problem. Some DNS hosts append your domain to the host name, so pasting the full name creates xxxxxxxxxxxxxx.pm._domainkey.example.com.example.com. Type only xxxxxxxxxxxxxx.pm._domainkey on those hosts. Then check with dig <selector>._domainkey.example.com txt, which should return the same value Postmark shows.
Rotating the key
Because the key is a TXT record you own, rotation is manual. Postmark suggests generating a new key at least every three months: click Generate New under the existing key on the DNS Settings page, publish the new selector, then click Verify. Postmark revokes the old key once the new one verifies. It suggests leaving the old TXT record in place for a few days so messages already in transit still verify.
SPF: the custom Return-Path
By default, Postmark mail carries Return-Path: <pm_bounces@pm.mtasv.net>. SPF is checked on that domain, which Postmark controls, so SPF passes without any change to your SPF record. Postmark explains this in why you don't need to include Postmark in your SPF record.
Passing is not aligning, though. pm.mtasv.net does not match your From domain. To align, add the CNAME:
pm-bounces.example.com CNAME pm.mtasv.net
After it verifies, the header becomes Return-Path: <pm_bounces@pm-bounces.example.com>, a subdomain of your From domain.
Two details trip people up. Postmark's verification guide writes the default host name as pm_bounces, while its Return-Path article and troubleshooting page use pm-bounces. Use whatever your DNS Settings page shows, and enter the same alias in Postmark's Return-Path section. And if your host appends the domain to the value, you get pm.mtasv.net.example.com; Postmark's fix is a trailing dot, pm.mtasv.net..
On Cloudflare, Postmark says to switch off the orange-cloud proxy on this CNAME, because proxying can stop Postmark from verifying it.
In our scan of the Tranco top 1,000 domains on 19 October 2026, 3 root SPF records contained a Postmark include (mtasv.net). Postmark says that is not needed. When we resolved spf.mtasv.net the same day it listed only IP ranges, so it costs one lookup if you keep it, but it does nothing for alignment. Check your count with the SPF checker.
How Postmark aligns for DMARC
- DKIM alignment. Once the TXT key verifies, Postmark signs mail from your domain with
d=your domain. Aligned. - SPF alignment. Only with the custom Return-Path, and only under relaxed alignment, because
pm-bounces.example.comis a subdomain. Withaspf=sit fails.
Postmark's own SPF alignment note makes the point that DMARC needs only one of the two. DKIM alone is enough to pass. The Return-Path is still worth adding. It gives you a second aligned path if DKIM ever fails, for example when a key rotation is published wrongly and the new selector does not resolve.
Postmark practises the same setup on its own domain. On 19 October 2026, _dmarc.postmarkapp.com published p=reject; pct=100.
DMARC record
Add one TXT record at _dmarc.example.com:
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Postmark notes that Gmail and Yahoo do not require an enforcing policy, so p=none is a fine start. The DMARC generator writes the record, and the DMARC analyzer reads the XML reports in your browser.
Checking the result
Send a test through Postmark to Gmail and open Show original. Look for DKIM: PASS with your domain, SPF: PASS on pm-bounces.example.com, and DMARC: PASS.
From outside, run the DKIM checker with your own domain and the selector from your DNS Settings page, the SPF checker, and the DMARC checker.