The short version: Postmark verifies a domain with a DKIM TXT record, and it strongly recommends a custom Return-Path CNAME (on a subdomain like pm-bounces) so SPF is checked against your domain instead of Postmark’s. DKIM alignment alone is enough to pass DMARC, but adding the Return-Path gives you SPF alignment too, which is belt-and-braces for strict receivers. This guide covers both records, where to add them in Postmark, and how to confirm DMARC passes.
The records Postmark needs
Postmark generates the exact hostnames and values per account — copy those from the dashboard, not the placeholders below.
DKIM (TXT). Postmark publishes a public key under a selector on _domainkey. This is what makes Postmark sign as your domain and is the record that aligns DKIM for DMARC:
Type: TXT Host: 20240101._domainkey.example.com (selector is generated per domain) Value: "k=rsa; p=MIGfMA0GCSq..." (full public key from your Postmark dashboard)Custom Return-Path (CNAME). By default the envelope sender (Return-Path) is a Postmark domain, so SPF authenticates Postmark, not you. Pointing a pm-bounces subdomain at Postmark delegates the bounce domain to you, so SPF now aligns:
Type: CNAME Host: pm-bounces.example.com Value: pm.mtasv.net (use the exact target Postmark shows)Note you do not add an include: to your own SPF record for Postmark — SPF alignment comes from the Return-Path CNAME, whose target already publishes the correct SPF. Follow Postmark’s current screens: How do I verify a domain? and DKIM and Return-Path in Postmark.
Where to start in Postmark
In Postmark, open Sender Signatures (or Domains) and add your domain. Postmark then shows the DKIM TXT and the Return-Path CNAME with copy buttons. Paste each into your DNS host — see the registrar guides linked below — and click Verify in Postmark for each record. DNS usually propagates within minutes but can take up to a day. Once both show a green check, Postmark signs and routes your mail with your domain.
Why DMARC alignment matters here
DMARC passes only when SPF or DKIM aligns — the authenticated domain must match the visible From:. Postmark’s DKIM signs as example.com, so DKIM aligns and that alone satisfies DMARC; aligned DKIM is also the robust choice because it survives forwarding. The custom Return-Path adds aligned SPF on top, which some strict filters like to see. This is the classic case where SPF can pass for Postmark’s bounce domain yet DMARC still fails without alignment — see why SPF passes but DMARC fails and how to set up a custom Return-Path. For the full model read the complete SPF/DKIM/DMARC guide, and if you have no DMARC record yet, create a safe starter with the DMARC Generator.
Verify it worked
- Confirm the DKIM key resolves with the DKIM Checker using the selector Postmark assigned.
- Check your overall SPF is valid and under ten lookups with the SPF Checker.
- Validate the policy with the DMARC Checker, then send a real test through Postmark and confirm the header shows
dkim=passaligned to your domain anddmarc=pass.
Keep DMARC monitoring running so a broken source surfaces in a report, not in failed password-reset emails.
Common mistakes
- Adding DKIM but skipping the Return-Path. Your mail will pass DMARC on DKIM alone, but you lose SPF alignment and some strict filters weigh it. Add both.
- Appending your domain to the CNAME target. The value ends in
mtasv.netand must stay exact — don’t let your DNS panel appendexample.comto it. - Proxying the CNAME. On Cloudflare keep the Return-Path CNAME DNS-only (grey cloud) — see Cloudflare records.
- No DMARC record at all. Authentication with no policy gives receivers nothing to enforce and you no reporting. Publish at least
p=none. - Truncating the DKIM key. Paste the whole public key; a cut value fails verification.
- Mixing marketing mail onto the same domain. Keep transactional streams separate to protect their reputation — see separating transactional and marketing email.
Related setup guides: Mailchimp, Mailgun, Brevo, Klaviyo and Zoho Mail.