Postmark domain authentication

Start from the sending domain

Open the domain’s verification settings in Postmark and obtain the DKIM and custom Return-Path records for that domain. Domain verification and a single verified Sender Signature have different scope; choose the setup appropriate to the production sending identity.

Publish and verify

1. Give the DNS administrator the exact owner names, types and values shown in Postmark. Keep the account and domain context with the change request.
2. Publish the DKIM record and, when configuring the custom Return-Path, its issued CNAME. Do not place a DKIM private key in DNS.
3. Run Postmark’s verification after DNS publication. Resolve a record-name duplication or wrong record type before changing unrelated settings.
4. Send through the production stream to an address you control and inspect DKIM d=, the visible From domain and the actual envelope sender.

Evaluate DMARC alignment

A passing DKIM signature needs an aligned signing domain to satisfy DMARC through DKIM. A custom Return-Path can support SPF alignment. Do not assume that a verified status in the dashboard proves every From address and stream is configured correctly.

Keep changes reviewable

SendPoint recommendation: retain the issued record values, verification date and responsible administrator in the change record. During a provider migration or key rotation, preserve the old route until its queued mail and rollback requirements are accounted for.

Use the DNS publication workflow and DMARC policy progression when moving from verification to enforcement.

Sources

• Postmark domain verification
• Postmark DKIM setup
• Postmark custom Return-Path