How to Add Hostinger DNS Records for Optimal Email Security
Configuring your Hostinger DNS records for email security is the most reliable way to prevent spoofing, stop spam, and ensure your legitimate messages land safely in your recipients' inboxes. By implementing robust SPF, DKIM, and DMARC policies inside the Hostinger DNS zone editor, you establish cryptographic proof that your mail server is authorized to send on behalf of your domain. Before making adjustments, you can run a diagnostic using the Email Security Checker on XiaTools to instantly audit your current configuration and identify missing authentication mechanisms.
Understanding Essential Email Security Records
Proper email authentication relies on three foundational DNS record types working in unison. Without all three, mailbox providers like Google and Microsoft will likely flag your outbound messages as suspicious or reject them entirely.
SPF (Sender Policy Framework)
An SPF record is a single TXT record that explicitly lists all IP addresses and hostnames authorized to send emails for your domain. When a receiving server gets an email, it checks your domain's SPF record to verify if the sending server's IP is on your approved list.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic digital signature to the header of every outgoing email. The receiving mail server uses the public key published in your DNS records to decrypt the signature and verify that the email was genuinely sent by you and has not been altered in transit.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC ties SPF and DKIM together. It tells receiving servers what action to take if an email fails SPF or DKIM checks—ranging from taking no action (monitoring mode) to quarantining the email or rejecting it outright. It also provides daily aggregate reporting back to your administrative address.
Step-by-Step Guide to Adding DNS Records in Hostinger
Adding or modifying DNS records in Hostinger is straightforward, but requires careful attention to detail. Follow these steps to access your DNS zone and publish your security entries.
- Log in to your Hostinger account and navigate to the main dashboard.
- Locate your domain name and click the Manage button next to it.
- In the sidebar menu, find the DNS / Nameservers section and click on DNS Zone Editor.
- Scroll down to the Manage DNS records table where you can view existing entries.
- Select the appropriate record type from the dropdown menu (usually TXT for SPF, DKIM, and DMARC, or MX for mail exchange).
Exact Record Syntax and Examples
Getting the syntax right is critical. Even a single misplaced character can invalidate your entire email security setup. Here are exact record formats using example.com and documentation IP ranges like 192.0.2.0/24.
1. MX Records
MX records dictate which mail servers accept incoming mail for your domain.
Type: MX
Name: @ (or leave blank)
Priority: 10
Points to: mail.example.com
TTL: 14400
2. SPF Record
Your domain should only have one SPF record. If you use Hostinger email alongside a third-party provider, combine them into a single string.
Type: TXT
Name: @
Value: v=spf1 ip4:192.0.2.0/24 include:_spf.hostinger.com ~all
TTL: 14400
3. DKIM Record
DKIM records are typically provided by your email hosting provider. The name and value string will be specific to your mail service.
Type: TXT
Name: default._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQFAAOCAQ8AMIIBCgKCAQEA...
TTL: 14400
4. DMARC Record
Start with a monitoring policy (p=none) to review reports before moving to strict enforcement.
Type: TXT
Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100
TTL: 14400
Comparing Email Security Policies
| Record Type | Primary Purpose | Failure Action Options | Recommended Initial Setting |
|---|---|---|---|
| SPF | Authorizes sending IPs | SoftFail (~all) or HardFail (-all) |
~all during testing |
| DKIM | Cryptographic integrity | Rejection by receiving server | Active with provider key |
| DMARC | Policy enforcement & reporting | none, quarantine, reject |
p=none for reporting |
Verifying Your Configuration with Command Line Tools
After saving your records in Hostinger, wait a few minutes for global DNS propagation. You can verify your entries directly from your terminal or command prompt.
Using dig on Linux and macOS
To check your TXT records for SPF and DMARC:
dig example.com TXT
dig _dmarc.example.com TXT
Sample output snippet:
;; ANSWER SECTION:
example.com. 3600 IN TXT "v=spf1 include:_spf.hostinger.com ~all"
Using PowerShell on Windows
To query mail exchanger and text records:
Resolve-DnsName -Name example.com -Type TXT
Common Mistakes and How to Fix Them
- Multiple SPF records: Creating more than one SPF record breaks validation entirely. Always merge multiple include statements or IPs into a single TXT string.
- Typo in the DMARC prefix: Forgetting the leading underscore (
_dmarc) means mail servers will never locate your policy. - Not updating TTL: Keeping a high TTL before making changes can delay propagation. Lower your TTL to 300 seconds temporarily when making major security updates.
Email Security Setup Checklist
- Access the Hostinger DNS Zone Editor.
- Ensure only a single SPF TXT record exists.
- Add the correct DKIM public key provided by your mail host.
- Publish a DMARC TXT record starting with
p=none. - Verify records using command line tools or online checkers.