Some DNS providers do not allow the end users the ability to add the DMARC, SPF or DKIM records that are required for Valimail onboarding in their UI. [see also this article].
We have heard from our Enforce customers that AT&T is one such provider. But they do offer a workaround since the UI has limitations. AT&T DNS Support can add the require records for you if you file a ticket with them or email them directly.
AT&T DNS Changes: rm-dnschanges@ems.att.com or call 888-787-4288 prompt #3 to speak with the DNS Team
You will be required to provide your account ID and possibly your WAN IP to the support staff. You can get this from your portal.