Configure Postmark for DMARC alignment

Postmark passes DMARC through DKIM. Postmark handles DKIM key management and automatically rotates keys; you publish the keys they provide as TXT records in your DNS.

Add a sender signature in Postmark

Postmark requires a verified sender signature before it will send mail on behalf of your domain.

1. Go to Postmark > Sender Signatures.
2. Click Add Domain and enter your domain.
3. Postmark generates two TXT records for DKIM: one for the primary key and one for a rotation key. Both should be published.

The records look like:

pm._domainkey.yourdomain.com  TXT  "k=rsa; p=MIGf..."
pm2._domainkey.yourdomain.com TXT  "k=rsa; p=MIGf..."

Publish both in your DNS provider. Postmark also provides a Return-Path CNAME for bounce handling, which helps with SPF alignment.

Verify DKIM in Postmark

After publishing the DNS records, return to the Sender Signatures panel in Postmark and click Verify. Postmark will check that the records are live and update the status. You can also use the DKIM check tool to confirm the records resolve.

SPF for Postmark

Postmark recommends adding a Return-Path CNAME to align SPF. The CNAME routes bounces through Postmark's infrastructure and sets the envelope sender to a Postmark address under your domain:

pm-bounces.yourdomain.com  CNAME  pm.mtasv.net

If you configure this, set the Return-Path domain in your Postmark sender settings to pm-bounces.yourdomain.com. This makes the envelope sender pm-bounces.yourdomain.com, which shares the organizational domain with yourdomain.com, passing SPF alignment under relaxed mode.

Without the Return-Path CNAME, SPF alignment won't pass for Postmark mail. Since DKIM is the primary alignment path, this is acceptable, but configuring the Return-Path provides a second alignment path.

What to expect in DMARCdrift

With DKIM configured, Postmark mail appears in DMARCdrift reports as:

• Source: Postmark IP range (PTR hostnames are usually mtasv.net or postmarkapp.com)
• DKIM result: pass, d=yourdomain.com with selector pm
• SPF result: pass if you configured the Return-Path CNAME, fail otherwise
• DMARC result: pass (DKIM provides alignment)

If reports show DKIM failing for Postmark traffic, the most common cause is that the DKIM record wasn't published correctly or Postmark's key rotation generated a new record that needs to be republished. Check the Sender Signatures panel in Postmark for any warnings.

Postmark message streams

Postmark separates transactional and broadcast streams. DKIM signing applies at the sender signature level and covers both streams. If you use separate sender signatures for different streams, make sure each one is verified with DNS records published.

Next: Resend setup: DKIM and SPF for Resend transactional email.

See also: DKIM alignment: how DKIM signing domain matching works. SPF alignment: why the envelope sender matters and where it breaks.