Transactional

Postmark

Postmark deliberately refuses bulk marketing and focuses on transactional traffic, which gives its IP pools unusually clean reputation. Authentication uses a TXT-based DKIM plus an SPF include and a tracking CNAME.

DNS records to publish

Type	Host	Value
TXT	@	`v=spf1 include:spf.mtasv.net ~all` SPF
TXT	<selector>._domainkey	`k=rsa; p=<public key>` DKIM (Postmark generates the selector)
CNAME	pm-bounces	`pm.mtasv.net` Custom return-path

Authentication setup

SPF

Add include:spf.mtasv.net to your SPF record.

DKIM

Publish the TXT record Postmark provides per sender signature.

DMARC

Postmark customers can usually go to p=reject quickly because traffic is transactional-only.

Deliverability tips

Use Postmark Message Streams to separate broadcast (newsletter) from transactional — they cannot share a stream.
Configure a custom return-path (pm-bounces) so DMARC SPF can align.
Postmark blocks list providers automatically; if your platform handles bulk sending, choose a different ESP.

Postmark setup docs

Related providers