OVHcloud is both a host and a mailbox provider, which creates a recurring confusion: the domain, the DNS zone and the email plan can live in three different places, and automatic DKIM only works when the zone is at OVHcloud.
SPF
One SPF TXT record for the whole domain, including OVHcloud’s outbound servers:
v=spf1 include:mx.ovh.com ~allThat single include covers every shared plan (MX Plan, Email Pro, Hosted Exchange). OVHcloud recommends ending with -all rather than ~all — but only once every sender is in the record, third-party tools included. Moving to -all with one contractor forgotten means rejecting your own invoices.
DKIM
Activation happens in the control panel, not in the DNS zone: select the email plan, the domain concerned, the General information tab, then click the DKIM badge shown in red in the Diagnostic column and confirm.
If the domain’s DNS zone is managed at OVHcloud, configuration is automatic and offered by default when the service is created. If the zone is elsewhere — another registrar, Cloudflare, a corporate DNS — OVHcloud shows you two CNAME values to publish yourself. They must have propagated before you click Enable, otherwise activation fails with nothing to explain it.
DMARC
Publish the monitoring policy on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:your-address@yourdomain.comStay there long enough to identify every legitimate sender before tightening. The progression, step by step.
Common mistakes with OVHcloud
- The DKIM badge stays red although everything looks done: almost always the DNS zone hosted elsewhere, so the two CNAMEs were never published.
- The web hosting sends too. A contact form or a script on a site hosted at OVHcloud leaves through servers that are not necessarily those of the email service. Do not assume — look at what your reports say.
- Two plans on the same domain — a legacy MX Plan and then Exchange — are still covered by one SPF record. Creating a second invalidates both.
- Aliases and forwarders re-send a message without re-signing it: SPF breaks on forwarding, and only DKIM saves alignment. One more reason not to skip it.
Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge — without opening a single XML file.