SPF and DMARC at STRATO, IONOS and ALL-INKL
Where each host keeps its DNS settings, what it already publishes for you, and how to add your own SPF and DMARC records without breaking its defaults.
STRATO, IONOS and ALL-INKL host a large share of small German companies’ domains and mailboxes. All three publish SPF for their own mail servers by default, and two of them publish DMARC too. That helps until you add a newsletter tool or move mail to Microsoft 365: then a second record appears next to the host’s, and SPF or DMARC fails for everything. This guide follows each host’s help pages, read on 15 November 2026.
Whatever the host, two rules hold: one SPF record per domain and one DMARC record per domain. Edit the existing one; never add a second.
STRATO
Where: in the customer login, Domains → Domainverwaltung, the gear icon next to the domain, then the DNS tab. TXT records are under TXT- und CNAME-Records, button verwalten. The prefix you type is completed with your domain.
SPF. The STRATO SPF-Regel area offers ready-made choices. Standard STRATO Mailserver publishes v=spf1 redirect=_spf.strato.com, which allows STRATO’s servers only. If another service sends in your name, write your own SPF TXT record instead: saving it switches the rule to Keine STRATO SPF-Regel. Include STRATO in it if you still send through STRATO:
v=spf1 include:_spf.strato.com include:spf.brevo.com ~allDKIM. STRATO already signs mail sent through its servers; its CNAME records sit in the same section.
DMARC. STRATO enables a DMARC rule by default. To set your own policy or add a report address, choose Keine STRATO-DMARC-Regel, then create a TXT record with the prefix _dmarc, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.de, and click Einstellung übernehmen. Going back to STRATO’s rule is only possible once every _dmarc TXT record is deleted. Note that STRATO’s own mail servers do not send DMARC reports.
IONOS
Where: the Domains & SSL tile, the gear icon under Actions next to the domain, then DNS.
SPF. IONOS SPF is active by default for domains whose DNS is at IONOS. Add record → IONOS SPF (TXT) creates it if it is missing, and IONOS adds its servers to an SPF record that already exists for another service. If your DNS is elsewhere but your mailboxes are at IONOS, publish v=spf1 include:_spf-eu.ionos.com ~all there.
DMARC. Add record, choose TXT, enter _dmarc as host name (for a subdomain, _dmarc.sub), and the value in Value. Changes are live at IONOS at once and reach everyone within about an hour.
ALL-INKL
Where: in the KAS (technical administration), Tools → DNS-Einstellungen, then edit the domain.
SPF. ALL-INKL creates SPF and DKIM for its own mail server. Its SPF value is v=spf1 a mx include:spf.kasserver.com ~all. To add a service, edit that record (Name empty, Type TXT, Priority 0) rather than adding one. If KAS answers that DNS settings cannot be changed in your plan, a Zone Reset restores the default record, and also removes every record you added: use it with care.
DMARC. ALL-INKL publishes v=DMARC1; p=none; by default: a policy that watches but sends reports nowhere. Edit it (Name _dmarc, Type TXT) and add a rua= address so that you can read who sends in your name. If reports go to an address in another domain, that domain must publish a verification record, as ALL-INKL’s help explains.
Then check
Run the SPF checker and the DMARC checker on the domain: they read what the world sees, including a duplicate record left by the host’s default. When the reports show every service passing, follow From p=none to p=reject.