How to Set Up SPF, DKIM, and DMARC on Hostinger (2026 Guide)

If you use a custom domain for business email, you want recipients to recognize your messages as genuine. However, without proper email authentication, receiving email providers may have difficulty verifying whether messages are actually authorized by your domain.

This is where SPF, DKIM, and DMARC come in. These three email authentication standards help protect your domain against spoofing, improve email trust, and give receiving servers information they can use when evaluating incoming messages.

If you use Hostinger Email, you can configure these records through your domain's DNS settings. The process is straightforward once you understand what each record does and where to add it.

1. What Is Email Authentication?

Email authentication is a process that helps receiving email providers verify whether a message is authorized to come from a particular domain.

For example, imagine that your business owns example.com and uses [email protected] to communicate with customers.

Another person could attempt to send an email that appears to come from your domain without actually having permission to use it. This technique is known as email spoofing.

Email authentication helps receiving providers check whether the message is authorized and whether it passes the relevant verification requirements.

Three important standards are used for this purpose:

• SPF: Identifies the servers authorized to send email for your domain.
• DKIM: Uses a digital signature to help verify that an email is associated with an authorized sending domain and has not been altered in transit.
• DMARC: Tells receiving providers how to handle messages that fail DMARC authentication and can provide reports about authentication activity.

2. What Are SPF, DKIM, and DMARC?

What is SPF?

SPF stands for Sender Policy Framework. It is a DNS TXT record that identifies which mail servers are authorized to send emails on behalf of your domain.

When a receiving server gets an email, it can check the domain's SPF record to determine whether the sending server is authorized.

For example, a standard Hostinger Email SPF record is:

v=spf1 include:_spf.mail.hostinger.com ~all

Here is what the different parts mean:

• v=spf1 identifies the SPF version.
• include:_spf.mail.hostinger.com authorizes the sending infrastructure specified by Hostinger.
• ~all indicates a soft-fail result for senders that do not match the authorized mechanisms.

SPF is particularly important when you send messages from a custom domain using a hosting provider, business email service, or other authorized email platform.

What is DKIM?

DKIM stands for DomainKeys Identified Mail. It adds a digital signature to outgoing emails.

The sending server signs parts of the message using a private key. The receiving server can use the corresponding public key published in DNS to verify the signature.

This helps the receiving server check whether the message has been altered and whether the signature is associated with the sending domain.

DKIM records are commonly published as DNS records under a selector-specific name. For the standard Hostinger Email setup, these are configured using CNAME records.

For example, Hostinger's standard configuration uses selector names such as:

hostingermail-a._domainkey
hostingermail-b._domainkey
hostingermail-c._domainkey

The destination values are provided by Hostinger. You should copy them from your own domain settings rather than guessing or reusing another domain's values.

What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance.

It builds on SPF and DKIM by allowing a domain owner to publish a policy for handling messages that fail DMARC checks.

DMARC also checks alignment. This means the domain authenticated through SPF or DKIM must align with the domain shown in the message's visible From address according to DMARC rules.

A basic DMARC monitoring record can look like this:

v=DMARC1; p=none; rua=mailto:[email protected]

The main parts are:

• v=DMARC1 identifies the DMARC version.
• p=none asks receiving servers not to apply a quarantine or rejection policy based on DMARC failure.
• rua= specifies an address for aggregate DMARC reports, when the receiving provider supports sending them.

Replace [email protected] with a real address configured to receive reports. If you do not have a reporting mailbox, do not publish a placeholder address and assume reports will reach you.

3. Things to Check Before Setting Up SPF, DKIM, and DMARC

Before editing DNS records, confirm that your domain and email service are configured correctly. This helps prevent mistakes that could interrupt existing email delivery.

1. Confirm which email service you use

Hostinger offers different email-related services, and their DNS values are not necessarily the same.

For this guide, the main configuration is for standard Hostinger Email. If you use Titan Email, Google Workspace, or Hostinger Reach, follow the DNS values displayed for that specific service.

2. Find where your domain's DNS is managed

Your domain's DNS records are controlled by the provider responsible for its active nameservers.

For example:

• If your domain uses Hostinger nameservers, you can manage its DNS zone through Hostinger.
• If your domain uses Cloudflare nameservers, you generally need to add the records in Cloudflare.
• If your domain uses another registrar's nameservers, make the changes in that provider's DNS management area.

Changing records in the wrong DNS panel will not update the records that the internet currently uses.

3. Keep your existing DNS records safe

Before changing anything, take screenshots or export your current DNS records if your provider offers that option.

This is particularly important if your domain already has an active website, another email provider, or third-party email marketing services.

4. Hostinger Email DNS Records

For standard Hostinger Email, the manual domain setup uses MX records for incoming email, an SPF TXT record, DKIM CNAME records, and a DMARC TXT record.

The following are the standard values documented by Hostinger. Your own hPanel domain settings should be treated as the final reference if they show different values.

Standard MX records

Standard SPF record

Standard DKIM records

Standard DMARC record example

The @ symbol represents the root domain in many DNS management panels. Some providers ask you to leave the host field empty instead. Follow the instructions of the DNS provider you are using.

5. Connect Your Domain to Hostinger Email Automatically

If your domain already uses Hostinger nameservers, you may be able to configure the required email records automatically through hPanel.

This is usually the simplest option for beginners because Hostinger can add the necessary MX, SPF, and DKIM records without requiring you to enter each value manually.

Official instructions: Set up a domain for Hostinger Email automatically.

6. Add Hostinger Email DNS Records Manually

If your domain does not use Hostinger nameservers, you generally need to add the email records manually in the DNS zone managed by your current provider.

For example, if your domain uses Cloudflare nameservers, add the records in Cloudflare rather than making changes in Hostinger's DNS zone.

Step 1: Open Hostinger's domain connection settings

1. Log in to your Hostinger account.
2. Open the Emails section.
3. Find the domain associated with your mailbox.
4. Open its Domain settings or Connect Domain section.
5. Review the required MX, SPF, and DKIM values.

Step 2: Open your active DNS provider

Log in to the provider that manages your domain's DNS records. Find the DNS management, DNS zone, or Advanced DNS section.

Step 3: Add the MX records

Add the two MX records shown in the standard Hostinger Email configuration, including their priorities. If you already use another email provider, confirm that you intend to move incoming email to Hostinger before replacing existing MX records.

Step 4: Add the SPF TXT record

Create the SPF TXT record at the root domain. If an SPF record already exists, do not create another one. Review the existing authorized sending services and combine the required SPF mechanisms into one record.

Step 5: Add the DKIM CNAME records

Add the three DKIM CNAME records using the exact hostnames and destinations displayed in your Hostinger account.

Step 6: Add the DMARC TXT record

Create a TXT record with the host name _dmarc and a valid DMARC policy value. The monitoring example is:

v=DMARC1; p=none; rua=mailto:[email protected]

Step 7: Save and verify the records

Save the DNS changes and return to Hostinger's domain settings. Check the connection status after allowing time for propagation.

Official instructions: Set up a domain for Hostinger Email manually.

7. How to Configure the SPF Record on Hostinger

SPF is one of the most important records for outgoing email authentication. It helps receiving servers determine whether the server sending a message is authorized by your domain.

How to add an SPF record

1. Open your domain's active DNS management panel.
2. Select the option to add a new DNS record.
3. Choose TXT as the record type.
4. Enter @ as the host or name, or leave it empty if your DNS provider requires that format.
5. Enter the SPF value provided by Hostinger.
6. Use the default TTL unless your provider or Hostinger instructs otherwise.
7. Save the record.

For the standard Hostinger Email setup, the value is:

v=spf1 include:_spf.mail.hostinger.com ~all

What if an SPF record already exists?

This is one of the most common DNS configuration mistakes.

Suppose your domain already has an SPF record for another email provider. Adding a second SPF TXT record can cause SPF evaluation problems because a domain should publish only one SPF policy record.

For example, imagine the domain uses two sending services. Instead of publishing two separate SPF records, the authorized mechanisms need to be combined into one policy, following the instructions of both providers.

Do not blindly replace an existing SPF value. First identify every service that sends messages using your domain, including business email, website SMTP, and marketing platforms.

Official guide: Hostinger Email DNS Records.

8. How to Configure DKIM Records on Hostinger

DKIM allows receiving servers to verify a digital signature attached to outgoing messages. This signature helps establish that the message is associated with the signing domain and has not been altered in transit.

For standard Hostinger Email, DKIM is configured through three CNAME records.

How to add DKIM records

1. Open your Hostinger email domain settings.
2. Find the section containing DKIM or email deliverability records.
3. Copy the first DKIM hostname and its destination.
4. Open your active DNS provider.
5. Create a new CNAME record.
6. Enter the hostname in the Name or Host field.
7. Enter the destination in the Target or Points to field.
8. Save the record.
9. Repeat the process for the remaining DKIM records.

For the standard Hostinger Email configuration, the three selectors are:

hostingermail-a._domainkey
hostingermail-b._domainkey
hostingermail-c._domainkey

The corresponding destinations are:

hostingermail-a.dkim.mail.hostinger.com
hostingermail-b.dkim.mail.hostinger.com
hostingermail-c.dkim.mail.hostinger.com

Common DKIM configuration mistakes

• Adding a DKIM record as TXT when the provided Hostinger configuration requires CNAME.
• Entering an incorrect selector or destination.
• Adding the record to a DNS zone that is not active.
• Creating conflicting records with the same hostname.
• Copying DKIM values from another email service or domain.

If your email service provides custom DKIM values, use those instead of assuming that the default Hostinger Email selectors apply.

9. How to Configure a DMARC Record on Hostinger

DMARC adds another layer of protection by allowing domain owners to publish a policy for messages that fail DMARC authentication.

It also supports reporting, helping domain owners understand whether legitimate sending services are properly authenticated and whether unauthorized sources may be using their domain.

Step 1: Open your DNS management panel

Log in to the provider managing your domain's active DNS zone.

Step 2: Create a TXT record

Select TXT as the record type and enter the following details for a monitoring policy:

Step 3: Understand the DMARC policy options

The p tag controls the requested handling policy for messages that fail DMARC.

Step 4: Start with monitoring

If you are configuring DMARC for the first time, p=none is a cautious starting point. It allows you to collect reports and identify sending services that may need authentication changes.

After reviewing your reports and confirming that legitimate services pass authentication and alignment checks, you can consider a stronger policy.

What is the rua tag?

The rua tag specifies where aggregate DMARC reports can be sent.

These reports may include information about sending sources, authentication results, and messages associated with your domain. They are generally machine-readable XML reports, not ordinary email notifications.

Use an address that can receive reports and consider a dedicated reporting mailbox or a reputable DMARC reporting service if you receive a large volume of reports.

10. How to Verify SPF, DKIM, and DMARC Records

After adding the DNS records, verify that they are published correctly. Do not assume that saving a record means it is immediately visible everywhere.

Method 1: Check through Hostinger

1. Log in to your Hostinger account.
2. Open the Emails section.
3. Find your domain and open its domain settings.
4. Review the status of the MX, SPF, and DKIM configuration.
5. Check whether any records are still missing or require attention.

The available status indicators and dashboard labels may differ depending on your email product.

Method 2: Use DNS lookup tools

You can use DNS lookup services to check whether the records are publicly visible.

• DNSChecker – Check DNS records from different locations.
• MXToolbox – Check MX, SPF, and other email-related DNS information.
• Mail-Tester – Send a test email to receive a report about common email configuration and deliverability issues.

Check each record separately

Method 3: Send a test email

DNS lookups confirm whether records are published, but you should also test actual email authentication.

1. Send a message from your Hostinger mailbox to an external email account.
2. Open the received message.
3. Find the option to view the original message or full email headers.
4. Look for authentication results related to SPF, DKIM, and DMARC.
5. Check whether the results show pass, fail, or another status.

For Gmail, the Show original option can display authentication details in the message headers.

11. Common SPF, DKIM, and DMARC Setup Mistakes

Even when you copy the correct values, small DNS configuration mistakes can prevent email authentication from working as expected.

How long does DNS propagation take?

Hostinger states that DNS changes may take up to 24 hours to propagate. During this period, different DNS resolvers may temporarily return different results.

If a record does not appear immediately, wait and check again rather than repeatedly creating or deleting records.

Why does my email still go to spam after authentication?

Passing SPF, DKIM, and DMARC does not guarantee inbox placement. Email providers also consider sender reputation, message content, recipient engagement, sending volume, and other filtering signals.

Hostinger recommends improving deliverability through correct SPF and DKIM configuration, clear subject lines, clean contact lists, and email testing.

12. Hostinger Email vs Hostinger Reach: Important DNS Differences

One important detail is that Hostinger Email and Hostinger Reach are different products. They do not necessarily use the same SPF and DKIM records.

Hostinger Email is used for regular business mailboxes, while Hostinger Reach is designed for email campaigns and audience communication.

If you use both services on the same domain, you need to authorize the relevant sending services correctly. Do not create two separate SPF records. Use the combined value or instructions provided by Hostinger for your particular setup.

Official documentation: Hostinger Reach: How to Add SPF, DKIM, and DMARC Records.

13. Frequently Asked Questions

Editorial note: DNS record values and dashboard labels can vary by Hostinger email product and account configuration. This guide shows the standard Hostinger Email configuration and a monitoring-oriented DMARC example. Always confirm the exact records in your own Hostinger dashboard before publishing DNS changes.