# Hetzner

> Publish the SPF, DKIM, and DMARC records MailBlastr generates for your domain using the Hetzner Console (or legacy Hetzner DNS Console).

This guide walks through adding the DNS records MailBlastr generates for a domain using **Hetzner**. Add your domain in MailBlastr first to generate the records — see [Managing domains](https://www.mailblastr.com/docs/domains/managing) — and keep the [DNS records](https://www.mailblastr.com/docs/domains/dns) reference open for your exact DKIM record and region.

Hetzner has two DNS interfaces: the newer **Hetzner Console** and the legacy **Hetzner DNS Console**. The record values are identical in both; only the navigation to the editor differs.

> **Warning:** Hetzner requires the **MX value to end with a trailing dot** (`feedback-smtp.us-east-1.amazonses.com.`). Removing the dot will cause verification to fail.

## Open the DNS editor

1. **New Hetzner Console** — Log in at console.hetzner.com, choose your project, click **DNS** under **Networking**, then select your domain from the **DNS zones** list.
2. **Legacy DNS Console** — Alternatively log in at dns.hetzner.com, choose your domain from **Your Zones**, and open the **Records** tab.
3. **Add each record** — Use the **Add Record** form for every entry below — the DKIM TXT record, the SPF MX and TXT, and the DMARC TXT.

## DKIM — TXT

Add **one** TXT record holding your domain’s DKIM public key. Enter only the host prefix in **Name** — Hetzner appends your zone. Copy the value from your domain configuration page in MailBlastr.

**DKIM — TXT**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Type` | TXT | No | A single DKIM key record. |
| `Name` | mailblastr._domainkey | No | Combined with the zone this is `mailblastr._domainkey.example.com`. `mailblastr` is the fixed selector MailBlastr uses. |
| `Value` | v=DKIM1; k=rsa; p=<public key> | No | The DKIM key record holding your domain’s public key. |
| `TTL` | 1800 | No | Hetzner value used in these examples. |

## SPF — MX on the send subdomain

MailBlastr uses the custom MAIL FROM subdomain `send.example.com`. Choose **MX**, set **Name** to `send`, set **Priority** to `10`, and paste the MailBlastr MX value (with trailing dot) into **Value**.

**SPF — MX**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Type` | MX | No | Receives bounce and complaint feedback for the MAIL FROM subdomain. |
| `Name` | send | No | Resolves to `send.example.com`. |
| `Value` | feedback-smtp.us-east-1.amazonses.com. | No | Region-specific feedback host — keep the trailing dot. Replace `us-east-1` with your domain’s region. |
| `Priority` | 10 | No | Use `20`/`30` if `10` is already taken on that host. |
| `TTL` | 1800 | No | Hetzner value used in these examples. |

## SPF — TXT on the send subdomain

**SPF — TXT**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Type` | TXT | No | SPF policy for the MAIL FROM subdomain. |
| `Name` | send | No | Same host as the MX — resolves to `send.example.com`. |
| `Value` | v=spf1 include:amazonses.com ~all | No | Authorizes Amazon SES for the MAIL FROM subdomain. |
| `TTL` | 1800 | No | Hetzner value used in these examples. |

## DMARC — TXT on _dmarc

**DMARC — TXT**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Type` | TXT | No | DMARC policy record. |
| `Name` | _dmarc | No | Resolves to `_dmarc.example.com`. |
| `Value` | v=DMARC1; p=none; | No | A monitoring policy to start with. See [Implementing DMARC](https://www.mailblastr.com/docs/kb/dmarc). |
| `TTL` | 1800 | No | Hetzner value used in these examples. |

> **Note:** Hetzner gotchas: keep the **trailing dot** on the MX value; enter only the bare host prefix in **Name** (omit your domain); and never reuse an existing MX priority on the same host.

Once all six records are saved, return to MailBlastr and [re-verify the domain](https://www.mailblastr.com/docs/api/domains-verify). If it stays pending, see [What if my domain isn’t verifying?](https://www.mailblastr.com/docs/kb/domain-not-verifying).