How to Set Up DigitalOcean DNS Records for Email Marketing

You manage DNS records in DigitalOcean through the Networking section of the cloud control panel. DigitalOcean defaults to a TTL of 3600 seconds (1 hour) and uses a tabbed record creation interface. A frequent trap in DigitalOcean involves external CNAME targets. If you omit a trailing dot from an external hostname, DigitalOcean appends your root domain to the target, which breaks verification.

DigitalOcean DNS navigation and nameserver check

To access your DNS records in DigitalOcean:

1. Log in to the DigitalOcean Control Panel.
2. In the left navigation menu, click Networking.
3. Click the Domains tab, then click your domain name.

Before adding records, confirm that your domain points to DigitalOcean nameservers: ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com. If your domain points to another registrar or DNS service, records added in DigitalOcean will not resolve. Configure records at your active DNS host instead.

Adding a record in DigitalOcean

1. In the Create a new record panel at the top of your domain page, select the tab for your record type (TXT, CNAME, or MX).
2. Fill in the HOSTNAME field:
   • For root domain records (such as SPF), enter @.
   • For subdomains (such as _dmarc or DKIM selectors), enter only the prefix. DigitalOcean appends your domain name automatically.
3. Enter the target value:
   • For TXT records, enter your plain text string into the VALUE field. Do not wrap the value in quotation marks.
   • For CNAME records, enter the target hostname into the IS AN ALIAS OF field. Always append a trailing dot (.) to external hostnames (for example, s1.domainkey.example-esp.com.).
   • For MX records, enter your mail server hostname in MAIL PROVIDERS’ MAIL SERVER, and enter your priority integer into the PRIORITY field.
4. Leave TTL (SECONDS) at the default 3600 unless your email service specifies a shorter interval.
5. Click Create Record.

DigitalOcean details its record types and hostname rules in its DNS management guide.

Required authentication records

Receiving mail servers use these three records to verify that messages sent from your domain are authentic.

1. SPF (Sender Policy Framework)

• Record Tab: TXT
• HOSTNAME: @
• VALUE: The SPF string provided by your email platform, such as:

  v=spf1 include:_spf.google.com include:sendgrid.net ~all

• TTL (SECONDS): 3600

DigitalOcean displays a separate “SPF” tab in some interface views. That tab is for a deprecated DNS record type. Modern mail providers expect SPF records to be published as standard TXT records. Always use the TXT tab.

Merging multiple SPF records

A domain must only have one root SPF record. If you already use Google Workspace, Microsoft 365, or another mail server, an SPF record will already exist in your record list.

Do not create a second TXT record starting with v=spf1. Multiple SPF records cause receiving mail servers to fail evaluation with a PermError, sending your messages to spam folders or triggering delivery rejections.

To update an existing SPF record:

1. Scroll down to the record table and locate the existing TXT record starting with v=spf1.
2. Click Edit next to that record.
3. Add your email marketing provider’s include: mechanism before the closing qualifier (~all or -all). For example:

   v=spf1 include:_spf.google.com include:sendgrid.net ~all

4. Click the checkmark icon to save the update.

Do not place quotation marks around the string in the VALUE field. DigitalOcean handles formatting internally.

2. DKIM (DomainKeys Identified Mail)

Email providers supply DKIM records in either CNAME or TXT format:

CNAME-based DKIM

Most modern email platforms (such as Klaviyo, Postmark, SendGrid, and Amazon SES) use CNAME records:

• Record Tab: CNAME
• HOSTNAME: The selector prefix without your domain, such as s1._domainkey
• IS AN ALIAS OF: The target hostname ending with a trailing dot, such as s1.domainkey.example-esp.com.
• TTL (SECONDS): 3600

DigitalOcean requires a trailing dot on external hostnames. If you omit the dot, DigitalOcean treats the value as relative and appends your root domain, producing s1.domainkey.example-esp.com.yourdomain.com..

TXT-based DKIM

Some platforms provide a raw public key string:

• Record Tab: TXT
• HOSTNAME: The selector prefix, such as google._domainkey
• VALUE: The raw public key string starting with v=DKIM1; k=rsa; p=...
• TTL (SECONDS): 3600

Paste the full public key into the VALUE field without quotation marks.

3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

• Record Tab: TXT
• HOSTNAME: _dmarc (DigitalOcean attaches your domain name automatically)
• VALUE:

  v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100;

• TTL (SECONDS): 3600

Start with p=none to monitor delivery reports without affecting message flow. Once SPF and DKIM pass consistently for all authorized sending services, update the policy tag to p=quarantine or p=reject.

Optional deliverability and branding records

These records configure custom subdomains for bounce management and click tracking.

4. Custom return path (bounce domain) (optional)

• Record Tab: CNAME
• HOSTNAME: bounces (or the subdomain prefix specified in your platform settings)
• IS AN ALIAS OF: The mail server hostname ending with a trailing dot (such as pm.mtasv.net.)
• TTL (SECONDS): 3600

5. Branded tracking domain (optional)

• Record Tab: CNAME
• HOSTNAME: links (or track, click, or email as specified by your platform)
• IS AN ALIAS OF: The tracking hostname ending with a trailing dot
• TTL (SECONDS): 3600

Setting up custom MX records (if required)

If your email marketing service requires dedicated MX records for inbound message processing, reply handling, or sending subdomains:

1. Click the MX tab in the record creation form.
2. Enter the details:
   • HOSTNAME: @ for the root domain, or mail for a dedicated sending subdomain.
   • MAIL PROVIDERS’ MAIL SERVER: The mail server address provided by your platform (such as feedback-smtp.us-east-1.amazonses.com.). Include a trailing dot.
   • PRIORITY: The integer specified by your provider (such as 10).
   • TTL (SECONDS): 3600
3. Click Create Record.

If you run business mailboxes on Google Workspace or Microsoft 365, do not delete or overwrite your root MX records. Overwriting root MX records halts regular email delivery for your organization. Only add MX records for dedicated subdomains unless you are switching your primary email provider.

Verifying your DNS records

You can check whether your DigitalOcean records have propagated using Windows PowerShell and Resolve-DnsName:

Check SPF

Resolve-DnsName -Name yourdomain.com -Type TXT

Review the Strings column. Verify that only one SPF record exists and that your sending service mechanism is present.

Check DMARC

Resolve-DnsName -Name _dmarc.yourdomain.com -Type TXT

Confirm that the output contains your v=DMARC1; p=... record.

Check DKIM

Replace s1 with your provider’s specific selector:

Resolve-DnsName -Name s1._domainkey.yourdomain.com -Type CNAME

If your platform uses TXT-based DKIM, change -Type CNAME to -Type TXT. The output will display your provider’s target hostname or public key.

Check tracking and bounce records (if configured)

Resolve-DnsName -Name bounces.yourdomain.com -Type CNAME

The NameHost column should point to your email platform’s destination address.

Check MX records (if configured)

Resolve-DnsName -Name yourdomain.com -Type MX

The NameExchange column should list your designated mail servers with their numerical priorities under Preference.

Common troubleshooting issues

Issue	Root cause	Solution
CNAME destination is duplicated (target.com.yourdomain.com.)	The target hostname was entered without a trailing dot.	Add a period to the end of the destination hostname in the “IS AN ALIAS OF” field (such as target.com.).
Subdomain hostname is duplicated (_dmarc.yourdomain.com.yourdomain.com)	The full domain was typed into the HOSTNAME field.	Enter only the subdomain prefix (such as _dmarc). DigitalOcean appends your domain name automatically.
SPF status shows PermError	Multiple TXT records start with v=spf1.	Edit the existing SPF record, merge all include: mechanisms into that single record, and delete any duplicates.
SPF record fails to evaluate	The record was added under the legacy “SPF” tab instead of the “TXT” tab.	Re-create the record under the TXT tab and remove the entry from the SPF tab.
Records do not resolve externally	Domain registrar nameservers do not point to DigitalOcean.	Verify that your domain registrar lists ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com.
Business inboxes stop receiving messages	Root MX records were replaced with email marketing MX records.	Restore your original primary mail exchanger records, and configure email marketing MX records on a dedicated subdomain.