Configure SPF and DMARC in Plesk

Set up SPF and DMARC for your Plesk domains. Learn how to modify the DNS template, manage incoming SPF checks, and deploy DMARC policies.

Last updated: July 2026

In short: SPF and DMARC policies can be managed centrally in Plesk using the server-wide DNS template. While SPF is configured to specify authorized senders for outgoing mail and checks incoming mail under Linux, DMARC protects your domains using quarantine rules by default.

When mail server scanners like Kuveris identify issues with your SPF or DMARC records on a Plesk server, you can resolve them through the administrator panel. Plesk utilizes a server-wide DNS template to generate standard records for all hosted domains.

Setting Up SPF in Plesk

SPF (Sender Policy Framework) defines which mail servers are authorized to send email on behalf of your domain.

In Plesk, you configure the global template for outgoing SPF records: Go to Tools & Settings > DNS Settings (under “General Settings”) and edit the TXT DNS record related to SPF. This DNS record is always present in the server-wide DNS template

An example SPF record generated by Plesk is: example.com. TXT v=spf1 +a +mx +a:test.plesk.com -all

Other common SPF templates you can publish include:

Incoming SPF Checks on Linux

Besides publishing policies for outbound mail, Plesk for Linux features incoming SPF checks by default: In Plesk, you can set up an SPF policy for outgoing mail by specifying rules in a DNS record. In Plesk for Linux, SPF also checks incoming mail by default.

Setting Up DMARC in Plesk

DMARC (Domain-based Message Authentication, Reporting, and Conformance) coordinates with SPF and DKIM. It dictates how receiver servers should handle emails that fail verification checks.

You configure the server-wide DMARC template in the DNS settings panel: Go to Tools & Settings > DNS Settings (under “General Settings”). Edit the DNS records related to the DMARC policy. These DNS records are always present in the server-wide DNS template

Default DMARC Policy in Plesk

By default, Plesk deploys a quarantine policy which instructs recipient servers to deliver unauthorized emails to the spam folder: For example, the Plesk default DMARC policy is defined in the following record: _dmarc.<domain>. TXT v=DMARC1; adkim=s; aspf=s; p=quarantine

If you are just starting your DMARC rollout and want to monitor traffic without enforcing block actions, you can set the policy to p=none: _dmarc.<your domain>. TXT v=DMARC1; p=none

Domains Using External DNS

If your domains use external nameservers (such as Cloudflare, Route 53, IONOS, or Hetzner) instead of Plesk's DNS, you must copy the SPF and DMARC records from Plesk and manually publish them as TXT records in your external DNS provider's dashboard.

Verifying Your Setup

After updating the DNS template or publishing your records on external nameservers, verify your configuration using the free Kuveris scanner to ensure that your SPF and DMARC records are syntactically correct and accessible.

Further reading