How do I set up Postmark so its email passes DMARC?
Publish the records Postmark shows in your account for your domain.
Last read from the sources at the foot of this page.
What does Postmark ask me to publish?
Adding DKIM authentication to emails you send through Postmark requires that you add a DKIM record to your DNS. Once DKIM is set up and verified, emails sent through Postmark using the domain will be signed with DKIM.
Postmark makes the values for your account, so we do not print any here.
Where in Postmark are my values shown?
Navigate to your Sender Signatures tab. Under the domain you are adding DKIM authentication for, click DNS Settings or Add a DKIM DNS record . A DKIM record will be shown that needs to be added to your DNS as a TXT record.
In Postmark, open the Sender Signatures tab and select DNS Settings under your domain.
Copy each value from there exactly as shown, and add each record at your DNS host.
Will p=reject block Postmark email?
If you have a DMARC policy for your domain, a custom Return-Path that aligns with your domain achieves SPF alignment .
Not once Postmark signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Postmark gives you are on your domain.
Postmark says a custom Return-Path on your domain gives SPF alignment when you have a DMARC policy.
Before you raise your policy, read your DMARC reports and check that email from Postmark passes.
Where does this come from?
- Postmark: How do I set up DKIM for Postmark?postmarkapp.comRead 14 October 2026
- Postmark: How do I add a custom return-path?postmarkapp.comRead 14 October 2026
- RFC 7489, DMARCrfc-editor.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/