Some DNS providers do not allow the end users the ability to add the DMARC, SPF or DKIM records that are required for Valimail onboarding in their UI. [see also this article]. 

We have heard from our Enforce customers that AT&T is one such provider. But they do offer a workaround since the UI has limitations. AT&T DNS Support can add the require records for you if you file a ticket with them or email them directly. 

AT&T DNS Changes: or call 888-787-4288 prompt #3 to speak with the DNS Team

You will be required to provide your account ID and possibly your WAN IP to the support staff. You can get this from your portal.