How to Update DNS Records in IONOS

IONOS (formerly 1&1) is a major European hosting provider and domain registrar with a significant customer base worldwide. IONOS provides DNS management through its control panel, with both a guided mode for common record types and an expert mode for full control. This guide walks you through adding and editing SPF, DMARC, MTA-STS, and DKIM DNS records for your domain in IONOS. Each section includes the exact steps, correct field values, and IONOS-specific details to get your email authentication records configured correctly.

IONOS has redesigned its control panel multiple times, and some legacy 1&1 accounts may see a different interface than newer IONOS accounts. The steps below reflect the current IONOS panel layout. If your interface looks different, look for DNS Settings or DNS Records within your domain management section.

Accessing Your DNS Zone

1. Sign in to your IONOS account at ionos.com or my.ionos.com.
2. Navigate to Domains & SSL from the main menu or dashboard.
3. Select the domain you want to manage.
4. Click DNS or DNS Settings in the domain management menu.
5. You are now in the DNS settings page where you can view, add, edit, and delete DNS records.

IONOS displays records in a list format. To add a new record, click Add Record. To edit an existing record, click the Edit icon (pencil) next to it. IONOS may prompt you to choose between a guided setup wizard and expert mode — select Expert mode for full control over record type, name, value, and TTL.

Note: IONOS may have default DNS records configured for its own hosting services. Review existing records before adding new ones to avoid conflicts, particularly with TXT records that may contain auto-generated SPF values.

TXT Records

SPF Record

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses and services are authorized to send email for your domain. Your SPF record is published as a TXT record at the root of your domain.

1. In the DNS Settings page, click Add Record.
2. Select TXT from the record type options.
3. In the Host Name or Name field, enter @. IONOS uses @ to represent the root of your domain.
4. In the Value field, enter your SPF record: v=spf1 include:_spf.mxio.io ~all
5. Set the TTL to 1 hour (3600 seconds) if configurable. IONOS may use a default TTL that is acceptable for most configurations.
6. Click Save.

If you already have an SPF record, do not create a second one. Multiple SPF records cause a PermError and break email authentication entirely. Edit the existing TXT record that begins with v=spf1 and add include:_spf.mxio.io before the ~all or -all mechanism.

IONOS-specific note: IONOS may auto-generate an SPF record if you use IONOS email hosting. This auto-generated record typically includes include:_spf.perfora.net or similar IONOS mail server references. If you are migrating to a different email provider or adding mxio's Managed SPF, merge the include mechanisms into a single SPF record rather than creating a duplicate. For example: v=spf1 include:_spf.perfora.net include:_spf.mxio.io ~all

DMARC Record

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers how to handle email that fails SPF and DKIM checks. It also enables aggregate reporting so you can see who is sending email as your domain.

1. Click Add Record.
2. Select TXT from the record type options.
3. In the Host Name field, enter _dmarc. IONOS will append your domain, resulting in _dmarc.yourdomain.com.
4. In the Value field, enter your DMARC policy: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
5. Click Save.

Replace dmarc@yourdomain.com with the address where you want to receive DMARC aggregate reports. Start with p=none to collect data before enforcing. See the DMARC Deployment Guide for the full progression from none to quarantine to reject.

Note: mxio will support DMARC policy management in a future release.

CNAME Records

MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending servers that your domain supports TLS encryption for inbound email and that they should refuse to deliver over an unencrypted connection. The MTA-STS policy is published via HTTPS, and a CNAME record points to the policy host.

1. Click Add Record.
2. Select CNAME from the record type options.
3. In the Host Name field, enter _mta-sts. IONOS will append your domain automatically.
4. In the Points to or Value field, enter the CNAME target provided by your MTA-STS hosting service.
5. Click Save.

You also need a TXT record at _smtp._tls to publish the MTA-STS policy version identifier. Follow the same TXT record process described above, using _smtp._tls as the Host Name and the policy string as the Value.

Note: mxio will support MTA-STS hosting in a future release.

NS Delegation

DKIM Key Hosting

DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was sent by an authorized server and that the message body was not altered in transit. DKIM keys are published as DNS records under the _domainkey subdomain.

For centralized DKIM key management, you can delegate the _domainkey subdomain to a dedicated DNS host via NS records.

1. Click Add Record.
2. Select NS from the record type options. If NS is not available in the guided mode, switch to Expert mode to access all record types.
3. In the Host Name field, enter _domainkey. IONOS will append your domain, resulting in _domainkey.yourdomain.com.
4. In the Points to or Value field, enter the first nameserver provided by your DKIM hosting service.
5. Click Save.
6. Repeat for each additional nameserver (typically 2-4 NS records are required for redundancy).

Note: IONOS guided mode may not expose NS record creation. If NS records are not available in the guided interface, click the option to switch to Expert mode, which provides access to all standard DNS record types.

Note: mxio will support DKIM key hosting via NS delegation in a future release.

Verifying Your Changes

After adding or editing DNS records in IONOS, verify that your changes are live and correct.

1. Use the mxio SPF Checker to validate your SPF record. Enter your domain and confirm that the record resolves correctly, the lookup count is within the 10-lookup limit, and all your sending services are included.
2. Use the mxio DMARC Checker to verify your DMARC record is published and syntactically correct.
3. Use the mxio Domain Health tool for a full overview of your domain's email authentication status, including SPF, DKIM, DMARC, and MX configuration.
4. If you created NS delegation records for DKIM, use the Delegation Health tool to verify that the NS records are resolving correctly and the delegated zone is responding.

DNS propagation from IONOS typically takes 15 minutes to a few hours. Most changes are visible within 1 hour. If your changes are not appearing, clear your local DNS resolver cache and check again. IONOS also provides a built-in DNS check within the control panel that you can use for preliminary verification.

Troubleshooting

Guided mode vs. Expert mode

IONOS offers a guided mode that simplifies common DNS operations but hides advanced record types like NS. If you cannot find the record type you need, switch to Expert mode in the DNS settings. Expert mode provides full access to all DNS record types and field configurations.

Auto-generated SPF records

IONOS may auto-create SPF TXT records when you use IONOS email hosting. These records typically reference IONOS mail infrastructure (_spf.perfora.net or similar). If you need to add additional sending services, merge the include mechanisms into the existing record rather than creating a second SPF record. Use the SPF Checker to verify you have exactly one SPF record at the root.

Duplicate SPF records

Your domain must have exactly one SPF TXT record at the root. If you see two TXT records starting with v=spf1, delete one and merge the include mechanisms into a single record. Use the SPF Checker to confirm you have only one record after merging.

Host name field format

IONOS uses @ to represent the root domain. For subdomains, enter only the subdomain portion — IONOS appends the domain automatically. For example, to create a record at _dmarc.yourdomain.com, enter _dmarc in the Host Name field.

Legacy 1&1 accounts

If your account was created under the 1&1 brand and has not been migrated to the new IONOS panel, the navigation and field labels may differ from this guide. Look for equivalent options under DNS Management or Domains in the 1&1 control panel. The record types and values remain the same regardless of the interface version.

DNS settings locked by hosting package

Some IONOS hosting packages restrict DNS editing to prevent accidental misconfiguration. If you cannot add or edit records, check your hosting package settings or contact IONOS support to unlock DNS management for your domain.