[ DNS-provider guides ]

Publish email-authentication records in Hetzner: configuration and verification

Configure authentication for Hetzner managed mail while keeping external DNS and application relay paths in scope.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Verify the active service and authoritative DNS before editing.
  • Preserve record types, owner names and existing authorized services.
  • Verify public answers and actual aligned mail separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify public answers and actual aligned mail separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the authoritative answers

Automatic records and external DNS need different checks.

Next steps

  1. Copy the displayed DKIM TXT record exactly.
  2. Reconcile the one SPF policy.
  3. Compare mailbox and relay headers.

CISO / SecOps

Protect keys and routing continuity

A relay workaround is more than an authentication toggle.

Next steps

  1. Keep private keys out of DNS and tickets.
  2. Review local mailbox dependencies.
  3. Require aligned receiver evidence.

Founder / Non-technical

Separate hosting from mail delivery

The hosting location does not identify every sending path.

Next steps

  1. Assign a mail-flow owner.
  2. Include application mail in acceptance.
  3. Approve migration rollback before switching.

[ FAQs ]

Frequently asked questions

Does this guide cover a self-managed Hetzner Cloud mail server?

No. It covers the documented konsoleH managed-email workflow; a self-managed server needs its own signing and delivery configuration.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What changes when nameservers are external?

Publish the DKIM TXT record displayed by Hetzner at the actual authoritative DNS provider rather than assuming konsoleH can update it.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does the default SPF authorize my other services?

Not necessarily. Inventory external senders and reconcile their approved authorization into one policy at the relevant owner.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I disable the local mail system to fix DKIM?

No. That is part of a specific Microsoft 365 migration workaround and requires a review of mailbox and routing dependencies.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Is the relay login address the visible From address?

Not necessarily. The documented relay separates SMTP authentication from the sender displayed to the recipient.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can a subdomain DKIM signature align with a parent From domain?

It may under relaxed alignment when the organizational-domain relationship is correct; strict alignment requires exact domain equality. Verify the active policy and observed message.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does successful SMTP authentication prove DMARC?

No. SMTP login grants submission access. DMARC is evaluated at receipt using passing aligned SPF or DKIM identities.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What should be retested after a mailbox migration?

Normal mailbox mail, application mail, receiving routes and the authentication identities visible at controlled external recipients.

Email security with DKIM SPF and DMARC Set up SMTP relay RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Email security with DKIM SPF and DMARC

    Sections Enable DKIM29–33; SPF with konsoleH Nameservers50–55

  2. Set up SMTP relay

    Sections Scoped migration9–18; Addon Domain20–30; SMTP mailbox39–46; DKIM/SPF48–61; SMTP connection63–72

  3. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  4. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  5. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Authoritative DNS
The nameservers responsible for publishing the domain’s DNS answers.
SMTP authentication
The login used to submit a message to a mail service, distinct from recipient-side domain authentication.
Alignment
The required relationship between an authenticated domain and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base