Managing DNS, SPF and DKIM at DMA

Q: Where do I manage my DNS at DMA?

In the client portal at https://klant.dma.nl, where you manage domains, DNS records, contacts and billing. For advanced or delegated management there is PowerAdmin at https://dns.dma.nl/dnsadmin.

Q: Can a third party or AI agent manage my DNS?

Yes. DMA can create a scoped account in PowerAdmin limited to explicitly named domains. Request one via support@dma.nl, stating the domains and who should get access.

Q: Which nameservers does DMA use?

ns.dma.nl, ns2.dma.nl and ns3.dma.nl. If these are set as a domain's nameservers, its DNS is managed at DMA.

Q: How do I set up an SPF record for email at DMA?

Add a TXT record on the domain itself. For email sent through DMA: v=spf1 a mx include:_spf.dma.nl -all. Use only one SPF record per domain.

Q: How do I set up DKIM?

DKIM is usually a CNAME record on a selector, for example default._domainkey.yourdomain.nl pointing to dkim.registrar.eu. DMA provides the correct selector and target value.

Q: What is DMARC and do I need it?

DMARC is a TXT record at _dmarc.yourdomain.nl that tells receivers what to do with mail failing SPF/DKIM. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.nl to monitor, then raise to p=quarantine or p=reject.

Where do you manage your DNS?

DMA offers two places for DNS management, depending on what you need.

Client portal

https://klant.dma.nl

For most customers. Manage your domains, DNS records, contact details, invoices and services here. This is the starting point for editing records yourself.

PowerAdmin (advanced)

https://dns.dma.nl/dnsadmin

Our advanced DNS management environment. Here DMA can create a scoped account that only grants access to explicitly named domains, ideal for delegation.

Does DMA manage your DNS? Check your domain's nameservers. If ns.dma.nl, ns2.dma.nl or ns3.dma.nl are set, the DNS is managed at DMA and you can use the portals above.

Our nameservers

DMA internet services' authoritative nameservers:

ns.dma.nl
ns2.dma.nl
ns3.dma.nl

Delegating DNS management to a third party or an AI agent

Want an external administrator, a vendor or an AI assistant to make DNS changes for you? DMA can create a scoped account in PowerAdmin that only has access to the domain names you designate. The account cannot see or change anything outside those domains.

Request one by email. Include:

the exact domain name(s) that need access;
who (or which party/assistant) should get access;
whether it is one-off help or ongoing management.

Request a scoped account via support@dma.nl

For security reasons we never hand out full account administrator rights. Delegated access is always limited to explicitly named domains.

Email records: SPF

An SPF record (a TXT record on the domain itself) tells receivers which servers may send email on behalf of your domain. For email sent through DMA:

Name	Type	Value
`@` (the domain itself)	TXT	`v=spf1 a mx include:_spf.dma.nl -all`

yourdomain.nl.  IN  TXT  "v=spf1 a mx include:_spf.dma.nl -all"

What does this mean?

Part	Meaning
`v=spf1`	SPF version.
`a` / `mx`	Allow the domain's A and MX hosts.
`include:_spf.dma.nl`	Allow DMA's mail servers.
`-all`	Reject everything else (strict). Use `~all` to test more softly first.

Use at most one SPF record per domain. If you also send via another service (newsletter, CRM), add their include: to that same record instead of creating a second SPF record.

Email records: DKIM

DKIM digitally signs your outgoing email. At DMA, DKIM is typically set up with a CNAME record on a selector pointing to the mail provider's key. Example (as DMA uses it itself):

Name	Type	Value
`default._domainkey`	CNAME	`dkim.registrar.eu.`

default._domainkey.yourdomain.nl.  IN  CNAME  dkim.registrar.eu.

The exact selector (here default) and the target value depend on your mail platform. DMA provides these values when setting up your email. Unsure? Ask via support@dma.nl.

Email records: DMARC

DMARC builds on SPF and DKIM and determines what receivers do with email that fails the checks. It is a TXT record at _dmarc.yourdomain.nl. Start soft and monitor first:

_dmarc.yourdomain.nl.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.nl"

Once the reports show that legitimate mail passes SPF and DKIM correctly, raise the policy to p=quarantine and eventually p=reject for maximum protection against abuse of your domain.

Frequently asked questions

Where do I manage my DNS at DMA?

In the client portal at klant.dma.nl. For advanced or delegated management there is PowerAdmin at dns.dma.nl/dnsadmin.

Can a third party or AI agent manage my DNS?

Yes. DMA can create a scoped account limited to explicitly named domains. Request one via support@dma.nl.

Which nameservers does DMA use?

ns.dma.nl, ns2.dma.nl and ns3.dma.nl.

How do I set up an SPF record for email at DMA?

Add a TXT record on the domain itself: v=spf1 a mx include:_spf.dma.nl -all. Use only one SPF record per domain.

How do I set up DKIM?

Usually a CNAME on a selector, for example default._domainkey.yourdomain.nl → dkim.registrar.eu. DMA provides the correct selector and target value.

What is DMARC and do I need it?

A TXT record at _dmarc.yourdomain.nl. Start with v=DMARC1; p=none to monitor, then raise to p=quarantine or p=reject.

Need help?

Stuck, or would you like DMA to make the change for you? Contact our support team. Mention your domain name and what you want to achieve and we will help you.

support@dma.nl