SPF, DKIM and DMARC at OVHcloud
Where the DNS zone is in the OVHcloud Control Panel, the SPF value for OVHcloud mail, the two DKIM CNAME records, and a DMARC record that sends you reports.
OVHcloud manages the DNS zone of most domains it registers, and its mail offers (MX Plan, E-mail Pro, Hosted Exchange) need three records in that zone to authenticate your mail. This guide follows OVHcloud’s documentation, read on 15 November 2026.
Where the DNS zone is
In the OVHcloud Control Panel: Web Cloud → Domain names, choose the domain, then the DNS zone tab. Add an entry creates a record; the pencil next to an existing one edits it.
If the domain is registered at OVHcloud but uses other DNS servers (the DNS servers tab shows them), the zone shown here is not the one the world reads: make the changes where your DNS is actually hosted.
SPF
The SPF value for OVHcloud’s shared mail offers is:
v=spf1 include:mx.ovh.com ~allOVHcloud usually creates it with the zone. If you also send through another service, add its include: to the same record:
v=spf1 include:mx.ovh.com include:spf.brevo.com ~allA frequent mistake in OVHcloud zones is two SPF lines: the original one and a new one pasted from a newsletter tool. Receivers then treat SPF as an error for every message. Merge them into one. Older zones may also hold an SPF-type record next to the TXT one: the SPF type is obsolete, keep the TXT record only.
DKIM
For MX Plan, E-mail Pro and Exchange, DKIM is set up from the e-mail offer in the Control Panel. When the domain’s zone is in the same OVHcloud account, the records are added for you. Otherwise the Control Panel shows two CNAME records to create in the zone of the domain: copy them exactly, then come back to finish the activation. Two records are needed because OVHcloud alternates between two keys.
DMARC
OVHcloud offers two ways: a DMARC entry type with a form, or a plain TXT record. Both produce the same thing, a record named _dmarc:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.frStart with p=none and an address that receives reports, read them for two weeks, then tighten: From p=none to p=reject. One DMARC record per domain; if the form created one, edit it rather than adding a TXT next to it.
Check
Allow up to 24 hours for a change to the zone to reach everyone. Then run the free SPF, DKIM and DMARC check, and send a test message to a mailbox elsewhere to read its headers with the e-mail header analyzer: you want dkim=pass with your domain and dmarc=pass.