DMARC at IONOS, Strato, All-Inkl and domainfactory: What Your Hoster Set, and What to Change

The short answer

Check your DMARC record first, because your hoster may have set one for you. At IONOS the typical default is p=none with no reports, so you should add a report address and move towards enforcement. At Strato the typical default is p=reject, so you should make sure every system sending in your name passes DKIM and add an SPF record. At All-Inkl and domainfactory there is usually no default, so you create the record yourself. You can test your domain in seconds with our free email deliverability check.

What the data shows

These figures come from our DMARC study of 23,488 company domains in Germany, Austria and Switzerland, grouped by the mail platform in the MX record.

The gaps are too large to be explained by company behavior. IONOS and Strato customers are both mostly small and mid-sized companies, yet 12.6% enforce DMARC at one and 80.2% at the other. The hoster's default decides.

To see those defaults directly, we looked up the exact records in a sample of 4,000 domains in November 2026. Among the IONOS-hosted domains in that sample, 76 of 129 carried exactly v=DMARC1; p=none;. Among the Strato-hosted domains, 35 of 62 carried exactly v=DMARC1; p=reject;. The remaining domains had individual records. The sample is small, so read these as a pattern rather than exact shares.

IONOS: DMARC is there, but it does nothing yet

A record with p=none tells receiving servers to take no action on failed messages. Without a rua address, nobody receives reports either. So the domain looks fine in a simple check, while anyone can still send forged mail in its name and you would not find out.

What to do:

1. Add a report address to the record, for example a mailbox or a report service. Our guide on reading DMARC reports explains what comes back.
2. Collect reports for two to four weeks and identify every sender.
3. Move to p=quarantine and then to p=reject, as described in moving from p=none to reject.

SPF is usually already in place. In our sample, most IONOS domains use include:_spf-eu.ionos.com. If you also send through Microsoft 365 or a newsletter tool, those senders need to be added to the same record, because a domain may have only one SPF record.

Strato: strict, and a trap for other senders

A record with p=reject asks receiving servers to refuse messages that fail DMARC. That is the protection you want, as long as all your legitimate mail passes. Strato signs its own outgoing mail with DKIM, so mail sent through Strato normally goes through, even without SPF.

The problem starts with everything else. An online shop, a CRM, a newsletter tool or a scanner that sends in your name without its own DKIM signature for your domain will fail, and the recipient may never see the message. If customers say your invoices or newsletters are not arriving, check this first.

What to do:

1. Add an SPF record. In our sample of 98 Strato domains, 42 had none. The ones that do mostly use redirect=_spf.strato.com or include:_spf.strato.com. If you also send through other services, use the include form so you can list them too.
2. Set up DKIM for your domain in every external tool that sends in your name.
3. Add a report address so you can see failures. The default record sends you none.
4. If you cannot fix an important sender at short notice, the Strato DNS settings let you switch off the default DMARC rule. Treat that as a temporary step.

All-Inkl and domainfactory: nothing until you add it

Neither sets a DMARC default, which explains the low numbers. In our sample most All-Inkl domains use include:spf.kasserver.com and most domainfactory domains use include:ispgateway.de for SPF.

What to do:

1. Create a TXT record at _dmarc.yourdomain.de with v=DMARC1; p=none; rua=mailto:your-address.
2. Enable DKIM in the hoster's mail settings or in your mail provider. Exact steps vary by package, so check your hoster's current help page.
3. Read the reports, then tighten the policy step by step.

The full setup, including exact records for Google Workspace and Microsoft 365, is in setting up SPF, DKIM and DMARC.

Before you change anything: list your senders

Most DMARC problems come from senders nobody remembered. Walk through this list with whoever runs your IT:

Does this matter for sales?

Yes, in two ways. If your own mail lands in spam or gets rejected, offers and invoices do not arrive. And large mailbox providers have made authentication a condition for bulk senders: Google and Yahoo since 2024, Microsoft since 2025. If you plan outbound campaigns, do not send from your main domain at all. We use dedicated sending domains, as described in our cold email deliverability guide.