DANE for email: who can use it, who can't — and what to use instead
DANE needs DNSSEC and TLSA at the MX — only the mail server operator can do that. Who supports it, who doesn't, and what to use otherwise.
English
Email security guides
Step by step, per provider, verified against primary sources.
SPF Who may send in your name? DKIM Signatures for your mail DMARC The enforceable policy TLS-RPT Reports on TLS delivery BIMI Your logo in the inbox MTA-STS Enforce encryption DANE Pin certificates in DNS News Announcements, launches, changes
Latest guides
Choose your provider: email-security setup guides by host
Pick your host and jump straight to its SPF, DKIM, DMARC, TLS-RPT, MTA-STS, DANE and BIMI guides — from IONOS to Microsoft 365 to Mailcow.
MTA-STS at shared hosts: what works, what doesn't
Why MTA-STS isn't a toggle at the German shared hosts — and which paths remain open to you anyway.
SPF vs DKIM vs DMARC: how they fit together
SPF, DKIM and DMARC aren't alternatives — they're a stack. What each one does, why DMARC ties them together, and how to reach enforcement safely.
What is email authentication? SPF, DKIM, DMARC and the transport layer
SPF, DKIM and DMARC prove who sent your mail; TLS, MTA-STS and DANE protect it in transit. The full stack, explained — with links to every setup guide.
Setting up BIMI at All-Inkl
BIMI at All-Inkl: the default._bimi TXT record in the KAS — plus the real prerequisites DMARC, SVG logo, and VMC.
Setting up BIMI at checkdomain
BIMI at checkdomain: the default._bimi TXT record in the pro settings — plus DMARC, SVG logo, and VMC.
Setting up BIMI at Cloudflare
BIMI at Cloudflare: the default._bimi TXT record in the dashboard — plus DMARC, SVG logo, and VMC.
Setting up BIMI at domainfactory
BIMI at domainfactory: the default._bimi TXT record in the nameserver settings — plus DMARC, SVG logo, and VMC.
Setting up BIMI at Gandi
BIMI at Gandi: the default._bimi TXT record in LiveDNS — plus DMARC, SVG logo, and VMC.
Setting up BIMI at GoDaddy
BIMI at GoDaddy: the default._bimi TXT record in the Domain Portfolio — plus DMARC, SVG logo, and VMC.
Setting up BIMI for Google Workspace
BIMI for Google Workspace: the default._bimi TXT at the DNS host — Gmail shows the logo only with a VMC/CMC.
Setting up BIMI at Hetzner
BIMI at Hetzner: the default._bimi TXT record in the Console — plus DMARC, SVG logo, and VMC.
Setting up BIMI at IONOS
BIMI at IONOS: the default._bimi TXT record — plus the real prerequisites DMARC, SVG logo, and VMC.
Setting up BIMI for Mailcow (self-hosted)
BIMI for Mailcow: the default._bimi TXT record — you host the logo yourself, plus DMARC and VMC.
Setting up BIMI for Microsoft 365
BIMI for Microsoft 365: the default._bimi TXT at the DNS host — plus DMARC, SVG logo, and VMC. Outlook shows BIMI with a VMC.
Setting up BIMI at Netcup
BIMI at Netcup: the default._bimi TXT record in the CCP — plus the real prerequisites DMARC, SVG logo, and VMC.
Setting up BIMI at OVHcloud
BIMI at OVHcloud: the default._bimi TXT record — plus the real prerequisites DMARC, SVG logo, and VMC.
Setting up BIMI at Amazon Route 53
BIMI at Amazon Route 53: the default._bimi TXT record in the console — plus DMARC, SVG logo, and VMC.
Setting up BIMI at Strato
BIMI at Strato: the default._bimi TXT record — plus the real prerequisites DMARC, SVG logo, and VMC.
Setting up BIMI at united-domains
BIMI at united-domains: the default._bimi TXT record — plus the real prerequisites DMARC, SVG logo, and VMC.
Setting up DKIM at All-Inkl
DKIM at All-Inkl: the TXT (DKIM) record in the KAS with your own selector — step by step with verification.
Setting up DKIM at checkdomain
DKIM at checkdomain: one switch under Emails → Security — enables SPF and DKIM together.
Setting up DKIM at Cloudflare
DKIM at Cloudflare: publish the public key as a selector._domainkey TXT record — for Cloudflare Email Service or your own mail server.
Setting up DKIM at domainfactory
DKIM at domainfactory: no wizard, but a TXT record with your sending service's key.
Setting up DKIM at Gandi
DKIM at Gandi: one toggle with LiveDNS — plus the 3 CNAME entries for external DNS.
Setting up DKIM at GoDaddy
DKIM at GoDaddy: no bare-domain wizard — your mail product generates the key, you publish it as a CNAME or TXT record.
Setting up DKIM for Google Workspace
DKIM for Google Workspace: generate the key in the Admin console, enter the google._domainkey TXT at your domain host.
Setting up DKIM at Hetzner
DKIM at Hetzner: konsoleH generates the key pair automatically — plus the TXT route for external DNS and your own servers.
Setting up DKIM at IONOS
DKIM at IONOS: active by default — plus the 3 CNAME entries for external DNS.
Setting up DKIM for Mailcow (self-hosted)
DKIM for Mailcow: generate the key in the UI, put the dkim._domainkey TXT in DNS — step by step with verification.
Setting up DKIM for Microsoft 365
DKIM for Microsoft 365: two CNAME selectors, activation in the Defender portal — incl. the new format since May 2025.
Setting up DKIM at Netcup
DKIM at Netcup: two CNAME entries in the CCP — key1 and key2 are both mandatory.
Setting up DKIM at OVHcloud
DKIM at OVHcloud: one-click activation for MX Plan/Email Pro, or two CNAMEs for external DNS — step by step.
Setting up DKIM at Amazon Route 53
DKIM at Amazon Route 53: CNAME records for SES-style delegation or a TXT public key for your own server — with the Route 53 apex caveat.
Setting up DKIM at Strato
DKIM at Strato: automatically active via smtp.strato.de — plus the CNAME selectors for your own nameservers.
Setting up DKIM at united-domains
DKIM at united-domains: automatically enabled for mailbox domains — except with external nameservers.
Setting up DMARC at All-Inkl
DMARC at All-Inkl: adjusting the pre-set _dmarc record — incl. authorizing external report addresses.
Setting up DMARC at checkdomain
DMARC at checkdomain: the _dmarc TXT record and the safe path from p=none to p=reject.
Setting up DMARC at Cloudflare
DMARC at Cloudflare: create the _dmarc TXT yourself in the dashboard — safely from p=none to p=reject.
Setting up DMARC at domainfactory
DMARC at domainfactory: create the _dmarc TXT yourself in the nameserver settings.
Setting up DMARC at Gandi
DMARC at Gandi: create the _dmarc TXT in LiveDNS — safely from p=none to p=reject.
Setting up DMARC at GoDaddy
DMARC at GoDaddy: the _dmarc TXT record in the Domain Portfolio — GoDaddy's ready value, safely staged to enforcement.
Setting up DMARC for Google Workspace
DMARC for Google Workspace: the _dmarc TXT at the domain host — the safe path from p=none to p=reject.
Setting up DMARC at Hetzner
DMARC at Hetzner: create the _dmarc TXT yourself in the DNS zone — safely from p=none to p=reject.
Setting up DMARC at IONOS
DMARC at IONOS: the _dmarc TXT record and the safe path from p=none to p=reject.
Setting up DMARC for Mailcow (self-hosted)
DMARC for Mailcow: the _dmarc TXT record and the safe path from p=none to p=reject.
Setting up DMARC for Microsoft 365
DMARC for Microsoft 365: the _dmarc TXT at the domain host — incl. the peculiarity of the high-risk outbound pool.
Setting up DMARC at Netcup
DMARC at Netcup: create the _dmarc TXT yourself in the CCP — safely from p=none to p=reject.
Setting up DMARC at OVHcloud
DMARC at OVHcloud: the _dmarc record via the DNS-zone assistant — start at p=none, then tighten.
Setting up DMARC at Amazon Route 53
DMARC at Amazon Route 53: create the _dmarc TXT yourself in the hosted zone — safely from p=none to p=reject.
Setting up DMARC at Strato
DMARC at Strato: default rule or your own _dmarc record — and why Strato itself sends no reports.
Setting up DMARC at united-domains
DMARC at united-domains: from p=none to p=reject via radio buttons — and securing unused domains right away.
Setting up SPF at All-Inkl
SPF at All-Inkl: the correct TXT entry in the KAS — step by step with verification.
Setting up SPF at checkdomain
SPF at checkdomain: the correct TXT entry in the pro settings — step by step with verification.
Setting up SPF at Cloudflare
SPF at Cloudflare: publishing the TXT record in the dashboard for your mail provider — step by step with verification.
Setting up SPF at domainfactory
SPF at domainfactory: the wizard in the nameserver settings — step by step with verification.
Setting up SPF at Gandi
SPF at Gandi: step by step to the correct TXT record in LiveDNS — including verification.
Setting up SPF at GoDaddy
SPF at GoDaddy: the TXT record in the Domain Portfolio — the ready value for GoDaddy mail, step by step with verification.
Setting up SPF for Google Workspace
SPF for Google Workspace: the right TXT entry at your domain host — with Google's own combined examples.
Setting up SPF at Hetzner DNS
SPF at Hetzner DNS: writing the record for your own mail server — step by step with verification.
Setting up SPF at IONOS
SPF at IONOS: step by step to the correct DNS record — including verification.
Setting up SPF for Mailcow (self-hosted)
SPF for Mailcow: the right TXT entry for your own mail server — including PTR and IPv6.
Setting up SPF for Microsoft 365
SPF for Microsoft 365: the right TXT entry at your DNS provider — with Microsoft's own recommendations.
Setting up SPF at Netcup
SPF at Netcup: the correct TXT record in the CCP — step by step with verification.
Setting up SPF at OVHcloud
SPF at OVHcloud: the built-in SPF assistant or your own record — step by step with verification.
Setting up SPF at Amazon Route 53
SPF at Amazon Route 53: writing the TXT record for your own mail server — step by step with verification.
Setting up SPF at Strato
SPF at Strato: predefined rule or your own record — step by step with verification.
Setting up SPF at united-domains
SPF at united-domains: one click under Email security — plus the manual path for your own mail servers.
Setting up TLS-RPT at All-Inkl
TLS-RPT at All-Inkl: the _smtp._tls TXT record in the KAS — for TLS delivery reports.
Setting up TLS-RPT at checkdomain
TLS-RPT at checkdomain: the _smtp._tls TXT record in the pro settings — for TLS delivery reports.
Setting up TLS-RPT at Cloudflare
TLS-RPT at Cloudflare: the _smtp._tls TXT record in the dashboard — the reporting companion to MTA-STS.
Setting up TLS-RPT at domainfactory
TLS-RPT at domainfactory: the _smtp._tls TXT record in the nameserver settings.
Setting up TLS-RPT at Gandi
TLS-RPT at Gandi: the _smtp._tls TXT record in LiveDNS — value under a subhost name.
Setting up TLS-RPT at GoDaddy
TLS-RPT at GoDaddy: the _smtp._tls TXT record in the Domain Portfolio — a standard record GoDaddy doesn't document, but readily hosts.
Setting up TLS-RPT for Google Workspace
TLS-RPT for Google Workspace: the _smtp._tls TXT record for TLS delivery reports — as a companion to MTA-STS.
Setting up TLS-RPT at Hetzner
TLS-RPT at Hetzner: the _smtp._tls TXT record in the Console — value in quotation marks.
Setting up TLS-RPT at IONOS
TLS-RPT at IONOS: the _smtp._tls TXT record in DNS management — for TLS delivery reports.
Setting up TLS-RPT for Mailcow (self-hosted)
TLS-RPT for Mailcow: the _smtp._tls TXT record for TLS delivery reports — companion to MTA-STS and DANE.
Setting up TLS-RPT for Microsoft 365
TLS-RPT for Microsoft 365: the _smtp._tls TXT record for TLS delivery reports — companion to MTA-STS.
Setting up TLS-RPT at Netcup
TLS-RPT at Netcup: the _smtp._tls TXT record in the CCP — for TLS delivery reports.
Setting up TLS-RPT at OVHcloud
TLS-RPT at OVHcloud: the _smtp._tls TXT record via the DNS-zone assistant — for TLS delivery reports.
Setting up TLS-RPT at Amazon Route 53
TLS-RPT at Amazon Route 53: the _smtp._tls TXT record in the console — value in double quotes.
Setting up TLS-RPT at Strato
TLS-RPT at Strato: the _smtp._tls TXT record via gear → DNS — for TLS delivery reports.
Setting up TLS-RPT at united-domains
TLS-RPT at united-domains: the _smtp._tls TXT record via the DNS entries — for TLS delivery reports.