[ Sending-service guides ]

Authenticate OVHcloud hosted email using the correct product and DNS branch

Choose the hosted-mail product, obtain its actual DKIM records, and verify public DNS and received-message alignment without applying hosted-mail settings to arbitrary OVHcloud servers.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Distinguish hosted mail from VPS and application relay routes.
  • Use product-issued selectors at the authoritative DNS host.
  • Separate shared-mail SPF from Private Exchange authorization.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Separate shared-mail SPF from Private Exchange authorization.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Follow the right product and DNS branch

Issued selectors must be published where recipients actually query them.

Next steps

  1. Capture the service-issued records.
  2. Verify authoritative DNS and both selectors.
  3. Inspect a received production-equivalent message.

CISO / SecOps

Require route-specific assurance

Hosted-mail success does not cover arbitrary servers in the same cloud.

Next steps

  1. Review explicit exclusions.
  2. Approve SPF changes against the sender inventory.
  3. Require alignment evidence and human sign-off.

Founder / Non-technical

Name the actual mail service

A domain or server invoice does not identify the outbound authentication route.

Next steps

  1. Confirm the hosted-mail product.
  2. Separate application relays from mailbox mail.
  3. Approve tests and operational recovery.

[ FAQs ]

Frequently asked questions

Does this cover a self-managed OVHcloud VPS mail server?

No. That route requires its own sending configuration and evidence.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Does an OVHcloud-registered domain necessarily use its DNS?

No. Check authoritative nameservers before editing a zone.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Can I use selector values from the documentation examples?

No. Retrieve the records for the actual service and domain.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Why retain both DKIM CNAME records?

The documented hosted-mail setup supplies two records. Publish the actual required set rather than only the currently observed selector.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Should I replace our SPF record with the OVHcloud example?

No. Shared MX Plan, Email Pro and Hosted Exchange use the documented shared authorization; Private Exchange has a separate IP-address branch. Confirm Zimbra-specific instructions rather than inferring them. Preserve other legitimate senders and the SPF evaluated-term limit.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Does a green diagnostic guarantee inbox placement?

No. Test receiver authentication and alignment, and treat delivery reputation separately.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Is an inbound DKIM verification setting the same as outbound signing?

No. Confirm that the control and evidence concern outbound signatures on the intended route.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

When can original scope be accepted?

After the intended hosted-mail scope is agreed, required live evidence is collected, and broader infrastructure routes are either covered or explicitly excluded.

OVHcloud DKIM record configuration OVHcloud SPF configuration SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

[ Sources ]

Sources

  1. OVHcloud DKIM record configuration

    Sections Requirements27–39; product activation121–198; API family241; five-step flow256 onward

  2. OVHcloud SPF configuration

    Sections Shared offers121–133; Private Exchange134–153; TXT entry110

  3. SPF RFC 7208

    Sections §3.2; 3.3; 4.6.4

  4. DKIM RFC 6376

    Sections §3.5; 3.6.2; 6.1

  5. DMARC RFC 9989

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

SPF
A mechanism for evaluating whether a connecting sender is authorized for an SMTP identity.
DKIM
A cryptographic message signature associated with a signing domain and selector.
DMARC alignment
The relationship required between an authenticated SPF or DKIM domain and the visible From domain.
Authoritative DNS
The delegated DNS service responsible for publishing the zone answers used by resolvers.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base