If your cPanel-hosted emails are landing in spam folders or bouncing back with authentication errors, the culprit is almost always missing or misconfigured email authentication records. SPF, DKIM, and DMARC are the three DNS-based standards that tell receiving mail servers your messages are legitimate. Without them, your domain looks like a phishing or spoofing target \u2014 and major providers like Gmail, Outlook, and Yahoo will routinely reject or quarantine your mail.<\/p>\n
cPanel includes built-in tools to generate and manage all three records. In fact, once you enable DKIM and configure an SPF record, cPanel can even help you set up a DMARC policy. This guide walks through each protocol step-by-step, from generating the DNS records inside cPanel to publishing them at your domain registrar. By the end, your outgoing email will pass authentication checks, your deliverability will improve, and your domain will be protected against email spoofing.<\/p>\n
<\/p>\n
Before jumping into cPanel’s configuration screens, it helps to understand what each protocol does and how they work together. SPF (Sender Policy Framework) publishes a list of mail servers authorized to send email for your domain. DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing message so the recipient can verify it hasn’t been tampered with. DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers what to do when SPF or DKIM checks fail \u2014 and sends you reports so you can monitor abuse.<\/p>\n
cPanel integrates all three at the DNS level. You do not need server-level access or command-line tools. Everything happens through the Email Deliverability<\/strong> and Zone Editor<\/strong> interfaces inside your cPanel dashboard. The key is enabling DKIM first, ensuring your SPF record covers all your sending sources, and finally adding a DMARC policy that ties everything together.<\/p>\n DKIM is the easiest to set up because cPanel can generate the key pair and publish the DNS record automatically. Follow these steps:<\/p>\n Once published, wait a few minutes for DNS propagation, then verify with a tool like MXToolbox or by using this command:<\/p>\n If the record returns a long key string, DKIM is active. Any email sent from your cPanel server will now carry a DKIM signature header.<\/p>\n SPF records tell receiving servers which IP addresses are allowed to send mail for your domain. cPanel adds a basic SPF record automatically when you create a domain, but you need to verify it covers all of your sending sources.<\/p>\n Open the Zone Editor<\/strong> in cPanel and look for a TXT record on your domain that starts with The If you send email through third-party services (Google Workspace, Mailchimp, SendGrid, and so on), you need to include their SPF includes. For example:<\/p>\n To add or modify the record:<\/p>\n One important rule: SPF has a 10-lookup limit. Every DMARC builds on SPF and DKIM by telling receiving servers what to do when authentication checks fail. It also generates aggregate reports you can review to spot unauthorized senders.<\/p>\n cPanel does not generate DMARC records automatically, but adding one takes only a minute:<\/p>\n Here is what each field means:<\/p>\n After a week or two of monitoring with Once all three records are published, test your setup before relying on it. You have several options:<\/p>\n If any authentication check shows DMARC reports are XML-based aggregate data sent to the email address you specified in the Reading raw XML reports is tedious. Use a free DMARC analyzer such as:<\/p>\n Check your reports weekly during the monitoring phase. If you see legitimate senders failing authentication, update your SPF record to include their servers. Once you see zero false positives, tighten your DMARC policy from If your cPanel-hosted emails are landing in spam folders or bouncing back with authentication errors, the culprit is almost always missing or misconfigured email authentication records. SPF, DKIM, and DMARC are the three DNS-based standards that tell receiving mail servers your messages are legitimate. Without them, your domain looks like a phishing or spoofing target … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[40,118,42,43,41],"class_list":["post-64","post","type-post","status-publish","format-standard","hentry","category-email-configuration","tag-cpanel-email-configuration","tag-dmarc-policy-cpanel","tag-email-authentication","tag-email-deliverability","tag-spf-dkim-dmarc"],"_links":{"self":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts\/64","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/comments?post=64"}],"version-history":[{"count":0,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts\/64\/revisions"}],"wp:attachment":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/media?parent=64"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/categories?post=64"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/tags?post=64"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Step 1: Enable DKIM in cPanel<\/h2>\n
\n
default._domainlink CNAME 10 yourdomain.com.dkim._domainlink.yourhost.com<\/code> or a TXT record with a long base64 key.<\/li>\ndefault._domainkey.yourdomain.com<\/code>.<\/li>\n<\/ol>\ndig txt default._domainkey.yourdomain.com +short<\/code><\/pre>\nStep 2: Configure Your SPF Record<\/h2>\n
Check Your Current SPF Record<\/h3>\n
v=spf1<\/code>. A typical cPanel-generated record looks like this:<\/p>\nv=spf1 +a +mx +a:server.yourhost.com ~all<\/code><\/pre>\n+a<\/code> and +mx<\/code> mechanisms authorize the domain’s A record and MX servers. The ~all<\/code> at the end is a soft-fail \u2014 it tells recipients to accept the message but mark it suspicious if it comes from an unlisted server.<\/p>\nCustomize for Your Sending Sources<\/h3>\n
v=spf1 +a +mx include:_spf.google.com include:sendgrid.net ~all<\/code><\/pre>\n\n
v=spf1<\/code>).<\/li>\ninclude:<\/code> statements for services you use.<\/li>\ninclude:<\/code>, a:<\/code>, mx:<\/code>, or ptr:<\/code> mechanism counts as a DNS lookup. If you exceed 10, SPF will permerror<\/code> and fail. Consolidate includes where possible.<\/p>\nStep 3: Add a DMARC Policy<\/h2>\n
Create the DMARC TXT Record<\/h3>\n
\n
_dmarc<\/code> as the name.<\/li>\nv=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100; sp=none<\/code><\/pre>\n\n
v=DMARC1<\/code> \u2014 Identifies this as a DMARC record.<\/li>\np=none<\/code> \u2014 The policy. none<\/code> means monitor only (no action taken). Start here until you are confident SPF and DKIM are working.<\/li>\nrua=mailto:...<\/code> \u2014 The email address where aggregate DMARC reports are sent.<\/li>\npct=100<\/code> \u2014 The percentage of messages to which the policy applies.<\/li>\nsp=none<\/code> \u2014 The policy for subdomains, which defaults to the main policy if omitted.<\/li>\n<\/ul>\nProgressing to a Stronger Policy<\/h3>\n
p=none<\/code>, review your DMARC reports. If you see no false positives (legitimate emails failing authentication), move to p=quarantine<\/code> (send failures to spam). Once you are confident everything is authenticated, use p=reject<\/code> \u2014 the strictest policy, which tells receiving servers to reject unauthenticated mail outright.<\/p>\nv=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100<\/code><\/pre>\nStep 4: Verify Email Authentication Is Working<\/h2>\n
\n
spf=pass<\/code>, dkim=pass<\/code>, and dmarc=pass<\/code>.<\/li>\ndig<\/code> available. Run dig txt _dmarc.yourdomain.com +short<\/code> to confirm your DMARC record is published.<\/li>\n<\/ul>\nfail<\/code> or permerror<\/code>, double-check each DNS record for typos. SPF records are especially fragile \u2014 a missing space or extra character breaks the entire record.<\/p>\nStep 5: Monitor DMARC Reports for Ongoing Protection<\/h2>\n
rua<\/code> tag. These reports show you every source that tried to send mail from your domain, along with whether SPF and DKIM passed or failed.<\/p>\n\n
p=none<\/code> to p=quarantine<\/code>, and eventually to p=reject<\/code>.<\/p>\nKey Takeaways<\/h2>\n
\n
p=none<\/code> for monitoring and only escalate to p=quarantine<\/code> or p=reject<\/code> after verifying no legitimate email fails authentication.<\/li>\nspf=pass<\/code>, dkim=pass<\/code>, and dmarc=pass<\/code> on every major email provider before finalizing your policy.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"