If you’ve ever sent an email from your cPanel account only to have it land in the recipient’s spam folder \u2014 or worse, get bounced entirely \u2014 the culprit is almost always missing or misconfigured email authentication. SPF, DKIM, and DMARC are the three DNS-based records that tell receiving mail servers “this email is legitimate and came from an authorized source.” Without them, your domain is wide open to spoofing, phishing impersonation, and deliverability failures.<\/p>\n
cPanel makes setting up these records straightforward, but you need to understand what each one does and how they work together. In this guide, we’ll walk through configuring SPF, DKIM, and DMARC step by step, verify everything is working, and troubleshoot the most common issues that trip up site owners.<\/p>\n
<\/p>\n
Email authentication is the practice of verifying that an email claiming to come from your domain actually originated from a server you authorized. Here’s what each protocol does:<\/p>\n
SPF (Sender Policy Framework)<\/strong> publishes a DNS record listing every mail server authorized to send email on your domain’s behalf. When a receiving server gets a message, it checks the SPF record. If the sending IP isn’t listed, the email fails the SPF check and is more likely to be rejected or flagged as spam.<\/p>\n DKIM (DomainKeys Identified Mail)<\/strong> uses a cryptographic signature attached to each outgoing message. Your mail server signs the email with a private key, and the receiving server looks up your public key in DNS to verify the signature hasn’t been tampered with. This proves the email genuinely came from your domain and wasn’t altered in transit.<\/p>\n DMARC (Domain-based Message Authentication, Reporting, and Conformance)<\/strong> tells receiving servers what to do when SPF or DKIM checks fail. It also sends you reports about authentication passes and failures so you can monitor for spoofing attempts. DMARC ties everything together with a policy of Without all three, your domain is essentially an open target for spammers who can forge your “From” address, damage your sender reputation, and harm your email deliverability for legitimate messages.<\/p>\n cPanel consolidates SPF and DKIM management inside the Email Deliverability tool. Here’s how to get there:<\/p>\n You’ll see a list of all domains associated with your cPanel account. Each domain shows its current authentication status \u2014 green for fully configured, yellow or red if something is missing or misconfigured.<\/p>\n If this is your first time here, most of your domains will likely show a warning. Don’t worry \u2014 we’re about to fix that.<\/p>\n The interface displays three columns per domain: SPF Status, DKIM Status, and Overall Status. If any column shows a warning icon or “Not Configured,” that record needs attention. cPanel can automatically generate the correct DNS records for most configurations, saving you from having to memorize syntax.<\/p>\n cPanel typically enables SPF by default for new accounts, but it’s worth verifying \u2014 and expanding \u2014 the record to include all services you use to send email.<\/p>\n Keep these rules in mind when constructing your SPF record:<\/p>\n DKIM setup in cPanel is handled directly inside the Email Deliverability interface as well, but the key generation happens in a separate tool.<\/p>\n You can check DKIM status from the cPanel interface \u2014 it should show DKIM: Enabled<\/strong> in green. For external verification, send a test email to a service like Mail-Tester.com<\/a> or Gmail (view the original message headers and look for If you see Unlike SPF and DKIM, cPanel’s Email Deliverability tool does not automatically create a DMARC record for you. You’ll need to add it to your DNS zone either through cPanel’s Zone Editor or your external DNS provider.<\/p>\n Your DMARC The The final \u2014 and most important \u2014 step is confirming that all three DNS records are published correctly and propagating.<\/p>\n Return to Email Deliverability<\/strong> and click your domain. The interface should now show green checkmarks for SPF, DKIM, and overall status. If any still show warnings, wait for DNS propagation (up to 48 hours, though usually 5-30 minutes) and refresh.<\/p>\n You can verify your records from outside cPanel using these free tools:<\/p>\n If you’ve ever sent an email from your cPanel account only to have it land in the recipient’s spam folder \u2014 or worse, get bounced entirely \u2014 the culprit is almost always missing or misconfigured email authentication. SPF, DKIM, and DMARC are the three DNS-based records that tell receiving mail servers “this email is legitimate … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[117,118,42,43,116],"class_list":["post-47","post","type-post","status-publish","format-standard","hentry","category-email-configuration","tag-dkim-configuration","tag-dmarc-policy-cpanel","tag-email-authentication","tag-email-deliverability","tag-spf-record-setup"],"_links":{"self":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts\/47","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/comments?post=47"}],"version-history":[{"count":0,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts\/47\/revisions"}],"wp:attachment":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/media?parent=47"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/categories?post=47"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/tags?post=47"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}none<\/code>, quarantine<\/code>, or reject<\/code>.<\/p>\nStep 1: Access the cPanel Email Deliverability Interface<\/h2>\n
\n
What to Look For<\/h3>\n
Step 2: Configure SPF Records in cPanel<\/h2>\n
\n
v=spf1 +a +mx +a:server.yourdomain.com ~all<\/code><\/li>\nv=spf1 +a +mx include:_spf.google.com ~all<\/code><\/li>\nSPF Record Best Practices<\/h3>\n
\n
include:<\/code> and mx<\/code> mechanism counts as a lookup. Exceeding 10 causes a permerror<\/code> and the SPF check will fail.<\/li>\n~all<\/code> (soft fail) during testing.<\/strong> This tells receiving servers to mark unauthenticated email as suspicious but still deliver it. Switch to -all<\/code> (hard fail) only after you’ve verified all legitimate senders are listed.<\/li>\n+all<\/code> under any circumstances.<\/strong> This says “any server can send email as my domain” and completely defeats the purpose of SPF.<\/li>\nStep 3: Generate and Enable DKIM for Your Domain<\/h2>\n
\n
default._domainkey.yourdomain.com<\/code>.<\/li>\nVerifying DKIM Is Working<\/h3>\n
dkim=pass<\/code>).<\/p>\ndkim=fail<\/code> or the signature is missing entirely, double-check that the TXT record’s value matches exactly what cPanel generated \u2014 including all quotation marks and semicolons. A single misplaced character causes the signature verification to fail.<\/p>\nStep 4: Publish a DMARC Record for Policy Enforcement<\/h2>\n
\n
_dmarc<\/code> (this becomes _dmarc.yourdomain.com<\/code>).<\/li>\n3600<\/code> (1 hour).<\/li>\nv=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100; fo=1<\/code><\/li>\nUnderstanding DMARC Policy Levels<\/h3>\n
p=<\/code> value determines what happens when email fails authentication:<\/p>\n\n
p=none<\/code><\/strong> \u2014 Monitoring mode. No action is taken against failing messages. Use this for at least two weeks after setup to collect data about your email traffic and identify any legitimate senders you might have missed.<\/li>\np=quarantine<\/code><\/strong> \u2014 Failing emails are sent to the recipient’s spam folder. This is a good intermediate step after you’ve confirmed legitimate email is passing authentication.<\/li>\np=reject<\/code><\/strong> \u2014 Failing emails are rejected outright. This provides the strongest protection against spoofing. Only switch to reject<\/code> after weeks of monitoring with p=none<\/code> and p=quarantine<\/code> have shown no legitimate messages being blocked.<\/li>\n<\/ul>\nrua=<\/code> tag specifies where aggregate DMARC reports are sent. Make sure the email address you use can receive reports \u2014 they can be large and numerous, especially for high-volume senders.<\/p>\nStep 5: Verify All Three Records Are Active<\/h2>\n
Using cPanel’s Built-In Check<\/h3>\n
Using External Verification Tools<\/h3>\n
\n
default._domainkey.yourdomain.com<\/code> as the selector and your domain to verify the DKIM public key is published and properly formatted.<\/li>\nKey Takeaways<\/h2>\n
\n
p=none<\/code> and monitor reports for at least two weeks before moving to p=quarantine<\/code> or p=reject<\/code>.<\/li>\n+all<\/code> under any circumstance.<\/li>\ninclude:<\/code> statements to your SPF record and ensure they support DKIM signing for your domain.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"