Hetzner DNS for Business Email: Zone, Nameservers and the Four Records

Hetzner's DNS Console is a free, plain zone editor that many people use for domains registered elsewhere, because their servers already live at Hetzner. It has no bundled mail product, so there is nothing to remove; the only extra step is making sure the domain actually uses Hetzner's nameservers before you add records there. This guide creates the zone, points the registrar at it, adds the four records, and notes the one thing to know about sending mail from a Hetzner server itself.

Quick answer

DNS (your domain's settings panel — like an address book for the web and email).hetzner.com, Add new zone, enter the domain. At your registrar set the nameservers to hydrogen.ns.hetzner.com, oxygen.ns.hetzner.com and helium.ns.hetzner.com. In the zone, add an MX at @ with priority 10 and value mail.oqumail.com, a TXT at @ with the SPF value, a TXT at the DKIM selector, and a TXT at _dmarc. Click Verify in OquMail.

The four records

• MX: host blank or @, value mail.oqumail.com, priority 10
• SPF: TXT at the root, value v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com ~all
• DKIM: TXT at the selector name shown in your OquMail dashboard, ending in ._domainkey, with the key value from the dashboard
• DMARC: TXT at _dmarc, value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com (use your own address)

Step by step

1. Log in at DNS (your domain's settings panel — like an address book for the web and email).hetzner.com with your Hetzner account and click Add new zone. Enter the domain. Hetzner offers to import existing records from the current nameservers; accept if the domain already has a website so those records carry over.
2. Note the three nameservers shown for the zone (hydrogen, oxygen and helium under ns.hetzner.com). At the registrar where the domain is held, replace the nameservers with those three. This can take up to a day to propagate; the records below can be added meanwhile.
3. Open the zone and click Add record. Type MX, Name @, Value mail.oqumail.com, with the priority 10 in the priority field (if the form shows a single value field, enter 10 mail.oqumail.com). TTL 300. Save.
4. Add record, Type TXT, Name @, Value v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com ~all. Save. Remove any other TXT at @ beginning v=spf1.
5. Add record, Type TXT, Name the DKIM selector exactly as the OquMail dashboard shows it (ending in ._domainkey, without the domain), Value the key. Save.
6. Add record, Type TXT, Name _dmarc, Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, using an address you read. Save.
7. When the registrar shows the Hetzner nameservers as active, go to the OquMail dashboard and click Verify.

Hetzner DNS quirks

• Records only take effect once the registrar points the domain at Hetzner's nameservers. The console cannot tell you whether that has happened; the MX lookup tool shows which nameservers are live.
• Name @ is the root. Hetzner shows the trailing-dot form of targets after saving (mail.oqumail.com.); that is normal.
• TXT values are shown quoted in the list; paste them plain in the form.
• The console has a text-mode zone editor under the zone menu for pasting all four records at once in zone-file syntax.
• DNSSEC is available; if you enable it, add the DS record at the registrar as well, or resolvers will fail the whole zone.

Sending mail from a Hetzner server

Hetzner Cloud blocks outbound ports 25 and 465 on new accounts for the first month and lifts the block on request. A mailbox on OquMail does not need either: your applications send on port 587 with STARTTLS or through the HTTPS API, both of which are open. The container and VPS guide has the code.

Confirm it works

Click Verify in the OquMail dashboard; the live check names any record still missing or mistyped. Then run the domain through the free MX lookup, SPF checker and DMARC checker, and send a message from webmail to a Gmail address, checking Show original for spf=pass and DKIM (a digital signature that proves your email was not tampered with)=pass. Changes usually take effect within minutes, occasionally up to 48 hours.

Common questions

Can I use Hetzner DNS for a domain registered at Hetzner?

Yes; the Hetzner domain registration (via Hetzner Robot) lets you set nameservers like any registrar, and the DNS Console zone works the same way.

Do I have to move the website too?

No. Importing the existing records when creating the zone keeps the A and CNAME records as they are; only the nameservers change.

Verify fails on everything.

The nameserver change has not propagated, or the registrar still lists the old ones. Check the NS records with the MX lookup tool; the records are fine and need the nameservers to catch up.

Want to see how your own domain is set up? Use the free SPF checker, DMARC checker and MX lookup: they run in your browser and store nothing.