Publish the mail provider’s sender-authentication records through PD BIND 9 DNS. DNS publication and actual mail-server signing are separate tasks: a DKIM record cannot make an unsigned message signed.

Prepare the authoritative values

Obtain the SPF policy for the sending domain, the DKIM selector and supplied record type/content, and the intended DMARC policy. Confirm which systems send mail before changing an existing policy. Keep current records available for comparison.

Add the requested records

1. Open the intended zone’s Records view.
2. Review the existing SPF TXT value at the sending domain.
3. Update the single intended SPF policy rather than adding conflicting SPF policies.
4. Add the DKIM TXT or CNAME requested for the exact selector name.
5. Add or edit the DMARC TXT record at the requested DMARC name.
6. Save and compare names, values and TTLs with the mail provider’s request.

Do not replace every TXT record just to change SPF. Keep unrelated verification values. For CNAME-based DKIM, do not place an ordinary TXT value alongside the alias at the same name.

Check a real message

Inspect authoritative DNS, then review a test message’s authentication results with the mail administrator. Compare the actual sender domain and DKIM selector with the records you published.

An unexpectedly strict DMARC policy can affect delivery where sending systems are not aligned. Use the intended policy from the mail administrator and check the actual outcome rather than copying a stronger example. If publication succeeds but authentication fails, retain redacted message results and exact selector/domain details; do not send full customer messages or unrelated account exports.

If the change cannot be activated

A successful validation and file write are separate from the running BIND service loading the change. If the result reports an activation or reload failure, preserve the exact redacted message and ask the server administrator to investigate. Check current records before repeating the write; do not assume an error means nothing changed.

See the PD BIND 9 DNS Blesta guide for related tasks, or explore the module.