Start with the authoritative zone
IONOS registration, IONOS DNS hosting and IONOS email are different responsibilities. This guide concerns publishing authentication records through the IONOS domain control panel, not configuring an IONOS mailbox or authorizing every IONOS sending service. The official documentation permits external name servers; records entered into an inactive IONOS zone do not become the Internet's answers. Establish the delegated zone and accountable administrator before preparing any edit. IONOS external name servers
For each requested change, record the complete owner name, record type, present value, proposed value, sending service and approving owner. Obtain DKIM material from the actual sender's account-specific instructions. A DNS host publishes public configuration; it cannot supply another service's signing key or prove that service signs messages. Keep private keys outside the DNS change request. DKIM key retrieval
Translate names before entering values
IONOS documents the TXT path as the domain's Actions menu, DNS, Add Record, then TXT. The form separates Host name, Value and optional TTL. Existing entries have an Edit record action. Its generic TXT page describes @ as a wildcard, but that wording should not become an authentication design assumption. A zone-origin abbreviation is not a promise to publish a policy at every descendant. Verify the resulting owner rather than relying on the symbol alone. IONOS TXT editor DNS master-file notation
The dedicated DMARC instructions are more precise: Host name _dmarc creates _dmarc beneath the selected domain. In a fictional example, choosing example.com and entering _dmarc should address _dmarc.example.com. This is a proposed expectation, not a captured IONOS result. Do not enter the domain suffix twice. For nested owners, retain the intended fully qualified name and require a published-answer comparison before acceptance. IONOS DMARC publishing
Preserve record boundaries and policy ownership
An existing TXT collection can contain unrelated verification tokens. Select the relevant authentication policy, not every TXT record at that owner. SPF permits one selected SPF policy; adding a second candidate is not how another sender receives permission. Any consolidation needs a sender inventory and evaluation of the DNS-querying terms, including dependencies reached through includes. Do not silently broaden authorization while tidying text. SPF record selection and limits
A TXT resource record may contain multiple character strings. For SPF these strings are concatenated without inserted spaces. Several strings inside one record are not several separately published SPF records. The reviewed IONOS instructions do not establish every long-value splitting, escaping or quotation behavior. Treat those editor details as an acceptance check: compare the authoritative data and record boundaries with the approved complete value. Do not manufacture a successful long-key experiment. SPF multiple strings TXT data format
Distinguish an alias from delegated authority
For a sender-provided DKIM CNAME, IONOS documents a subdomain DNS path, a Hostname field and a Point to target expressed as a fully qualified hostname without a web URL scheme. A selector alias is not an instruction to redirect a website or change the domain's mail routing. Confirm the exact selector and destination with the sending-service owner. IONOS CNAME workflow
IONOS warns when a new record conflicts with an active service. Stop at such a warning and identify the dependency before approving a replacement. Ordinary TXT and CNAME data cannot share the same alias owner. Separately, the provider supports subdomain NS records through the DNS editor; this delegates responsibility for a subtree and has a wider effect than publishing one key alias. Do not treat delegation as a workaround for an unexplained collision. IONOS conflicts IONOS subdomain delegation
Verify publication and mail independently
The proposed acceptance sequence begins with authoritative before-and-after queries for each exact owner and type, recording server, time, response code, answer and relevant delegation. Then compare a recursive observation and investigate any discrepancy. Positive caches and cached nonexistence are separate causes of stale answers. Negative caching uses the smaller of the SOA TTL and SOA MINIMUM for its initial lifetime, not MINIMUM alone. An editor's saved state and a one-hour documentation estimate are not a universal DNS convergence guarantee. DNS caching Negative caching lifetime
Next, an authorized operator should exercise the intended sending workflow and preserve the received message. Compare its visible From domain, SMTP envelope identity, DKIM signing domains and selectors with trusted receiver authentication results. RFC 9989 permits DMARC success through an aligned passing SPF or DKIM path; merely finding both DNS records proves neither path. A policy requests treatment and does not guarantee delivery or reporting. RFC 9990 specifies aggregate reporting separately. DMARC alignment Aggregate reporting Authentication-results trust
Keep recovery narrower than the incident
Before an approved change, retain the previous affected records and the reason each matters. IONOS zone backup and restoration require DNS Pro; restoration overwrites existing zone data. An available backup is therefore not permission to roll back unrelated changes. Have the owner choose a targeted recovery or a reviewed whole-zone restoration, then repeat the publication and message checks. This package performs neither action. IONOS backup scope
Evidence required before publication
The exact catalogue requirement is: A current IONOS publishing walkthrough with authoritative before/after queries and an independently verified message.
That requirement remains open. Public instructions were reviewed on 9 November 2026, without account access, live DNS queries, changed records or a received message. Current tenant labels, long-TXT handling, actual delegation, sender applicability, technical review, production-route checks, visual acceptance and owner approval still need evidence. The fictional name example and proposed verification sequence are preparation, not an executed walkthrough.