Setting up SPF, DKIM and DMARC on OVHcloud

Two checks are worth the quarter of an hour they save. First: is your domain's DNS zone actually at OVH? A domain bought from OVH can perfectly well be delegated to Cloudflare or another host, and in that case changes made in the OVH control panel have no effect whatsoever.

dig +short NS example.com
# dns*.ovh.net → the zone is at OVH

Second, establish what is already published. A second SPF record inherited from an old configuration invalidates the first, and a forgotten DMARC record can conflict with the one you are about to write.

dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

1. 01

   Open the DNS zone

   In the OVHcloud control panel: Web Cloud, then Domain names, then your domain, then the DNS zone tab. The “Add an entry” button sits above the table.

2. 02

   Publish SPF

   Choose the SPF type. The form offers “Use the SPF for OVHcloud web hosting”: that box authorises the web hosting's sending servers, which is not the same thing as your mailboxes. If your mail is on MX Plan or Email Pro you also need include:mx.ovh.com. If it is at Google or Microsoft, theirs is the include you need, and OVH's only matters if your website sends mail too.

   example.com.  IN  TXT  "v=spf1 include:mx.ovh.com 
                            include:spf.ovh.net -all"

3. 03

   Enable DKIM without touching DNS

   Since 2023 OVH generates and publishes the key itself on new-generation MX Plan and Email Pro. Go to Emails, select your service, open the General information tab and then the Security section, and switch DKIM on. The record appears in the zone by itself. On an older plan, or with third-party mail, the mail provider is the one who gives you the value to publish.

4. 04

   Publish DMARC in monitoring mode

   Here is this page's trap, and it is worth reading in full: see the next section. For a first record in monitoring the assisted form is enough. Choose the DMARC type, enter _dmarc as the subdomain, DMARC1 as the version, none as the rule, and your reporting address as rua.

5. 05

   Verify from outside

   Do not trust the control panel's own display: it shows what it recorded, not what the world resolves. Allow a few minutes for propagation, then query DNS from a public resolver.

   dig @1.1.1.1 +short TXT _dmarc.example.com
   dig @1.1.1.1 +short TXT example.com

OVH offers a DMARC entry type with a guided form, and for a first record that is a good idea. The form exposes only six tags: the version, p, pct, rua, sp and aspf.

So adkim is missing, the tag that sets DKIM alignment strictness. It is the tag that matters most once rejection is live, because DKIM is the check that survives forwarding. A domain configured only through this form will have aspf=s and a DKIM alignment left relaxed without anyone having decided it.

Subdomain : _dmarc
Type      : TXT
Value     : v=DMARC1; p=reject; rua=mailto:reports@example.com;
            adkim=s; aspf=s; pct=100

Publishing the three records does not protect your domain yet: while the policy is at p=none nothing is blocked. Reaching rejection takes two to three weeks of reading the reports, and is described in the guide on moving to rejection.

This page describes the OVHcloud interface as it stood on 22 August 2026. Providers move their menus; if the path no longer matches, the values to publish have not changed.