Email deliverability is one of the most common pain points for cPanel users. You might have configured everything correctly only to find your messages landing in spam folders or bouncing back entirely. More often than not, the culprit is missing or misconfigured email authentication records. SPF, DKIM, and DMARC are three DNS records that tell receiving mail servers your emails are legitimate and not forged spam. When all three are set up properly in cPanel, your sending reputation improves dramatically and your messages reach inboxes instead of junk folders.<\/p>\n
In this guide, you will learn exactly how to configure SPF, DKIM, and DMARC records directly from your cPanel dashboard. We will walk through each step, explain what each record does, and show you how to verify everything is working correctly using free online tools. Whether you are managing a single domain or dozens, this process ensures your email infrastructure is secure and trustworthy.<\/p>\n
<\/p>\n
Before diving into configuration, it helps to understand what each record does and why you need all three together.<\/p>\n
Sender Policy Framework (SPF) is a DNS record that lists every server authorized to send email from your domain. When a receiving mail server gets a message claiming to be from DomainKeys Identified Mail (DKIM) adds a digital signature to every outgoing email. This signature is generated using a private key stored on your cPanel server, and receiving servers verify it using a public key published in your DNS. If the signature matches, the email is confirmed to have been sent by your server and was not tampered with during transit. DKIM is especially important because it survives email forwarding, unlike SPF, which can break when messages are forwarded through intermediate servers.<\/p>\n Domain-based Message Authentication, Reporting, and Conformance (DMARC) tells receiving servers what to do when SPF or DKIM checks fail. You can instruct them to quarantine suspicious messages, reject them outright, or let them through and send you a report. DMARC also provides detailed XML reports that help you monitor who is sending email on behalf of your domain, making it an essential tool for detecting phishing attempts and spoofing campaigns.<\/p>\n Most cPanel hosting providers enable email services by default, which means your SPF record is usually auto-configured for the primary mail server. However, if you send email through third-party services like Google Workspace, Outlook 365, or a transactional email provider such as SendGrid or Mailgun, you need to update the SPF record to include those servers.<\/p>\n cPanel makes DKIM configuration remarkably simple through the Email Deliverability tool. This feature automatically generates the key pair and publishes the public key to your DNS.<\/p>\n Note:<\/strong> If your DNS is managed externally (for example, through Cloudflare), cPanel cannot add the DKIM record automatically. You will see the required values on the Email Deliverability page and must add them manually through your external DNS provider’s control panel.<\/p>\n DMARC policies are not auto-configured by cPanel, so you must add one manually through the Zone Editor. A DMARC record is a TXT record with a special subdomain format: Start with Once your DNS records have propagated, you should test them before relying on your new configuration. Several free tools make this easy.<\/p>\n Navigate to MXToolbox.com<\/a> and use the following lookups:<\/p>\n Send a test email from your cPanel-hosted address to a Gmail or Outlook inbox. Open the original message source (in Gmail, click the three dots \u2192 Show original<\/strong>). Look for these headers:<\/p>\n If any of these show as For high-volume senders, set up Google Postmaster Tools<\/a>. It provides detailed data on your domain’s spam rate, delivery errors, and authentication pass rates across Gmail, helping you spot problems before they affect your deliverability.<\/p>\n Even with careful setup, issues can arise. Here are the most common problems and how to resolve them.<\/p>\n SPF too many lookups:<\/strong> DNS lookup limits restrict SPF records to a maximum of 10 DNS queries. Every DKIM selector mismatch:<\/strong> Some email clients or third-party senders use a non-standard DKIM selector. If cPanel’s default selector ( DMARC policy too strict too quickly:<\/strong> If you set External DNS not syncing:<\/strong> If you manage DNS at your registrar or a service like Cloudflare, changes made in cPanel’s Zone Editor will not propagate. You must make all SPF, DKIM, and DMARC changes directly at your external DNS provider. Verify where your nameservers point before editing records.<\/p>\n Email deliverability is one of the most common pain points for cPanel users. You might have configured everything correctly only to find your messages landing in spam folders or bouncing back entirely. More often than not, the culprit is missing or misconfigured email authentication records. SPF, DKIM, and DMARC are three DNS records that tell … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[117,248,42,43,116],"class_list":["post-94","post","type-post","status-publish","format-standard","hentry","category-email-configuration","tag-dkim-configuration","tag-dmarc-policy","tag-email-authentication","tag-email-deliverability","tag-spf-record-setup"],"_links":{"self":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts\/94","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/comments?post=94"}],"version-history":[{"count":0,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/posts\/94\/revisions"}],"wp:attachment":[{"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/media?parent=94"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/categories?post=94"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpanelreview.com\/index.php\/wp-json\/wp\/v2\/tags?post=94"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}yourdomain.com<\/code>, it checks the SPF record to see if the sending IP address is on the approved list. If the server is not listed, the message may be flagged as spam or rejected outright. SPF is the first line of defense against email spoofing and is the oldest of the three authentication methods.<\/p>\nWhat is DKIM?<\/h3>\n
What is DMARC?<\/h3>\n
Configuring SPF Records in cPanel<\/h2>\n
\n
v=spf1<\/code>. If one exists, click Edit<\/strong>. If not, click Add Record<\/strong> and select type TXT<\/strong>.<\/li>\n
\nv=spf1 +a +mx include:_spf.yourhostingprovider.com include:spf.protection.outlook.com ~all<\/code><\/li>\n_spf.yourhostingprovider.com<\/code> with your hosting provider’s SPF include, and add an include<\/code> for each third-party service you use. The ~all<\/code> tag means “soft fail” \u2014 messages from unauthorized servers are marked as suspicious but not rejected.<\/li>\nEnabling DKIM Signing in cPanel<\/h2>\n
\n
Setting Up a DMARC Policy in cPanel<\/h2>\n
_dmarc.yourdomain.com<\/code>.<\/p>\n\n
_dmarc<\/code>. (cPanel appends your domain automatically.)<\/li>\n
\nv=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-reports@yourdomain.com; fo=1<\/code><\/li>\n\n
v=DMARC1<\/code> \u2014 The version identifier, always required.<\/li>\np=quarantine<\/code> \u2014 Instructs receivers to send failing messages to spam. Use p=none<\/code> initially to monitor without impact, then move to quarantine<\/code> and eventually reject<\/code>.<\/li>\npct=100<\/code> \u2014 Applies the policy to 100% of messages. Start at a lower percentage like 20 if you are testing.<\/li>\nrua<\/code> \u2014 The email address that receives aggregate DMARC reports (XML summaries).<\/li>\nruf<\/code> \u2014 The email address that receives forensic failure reports for individual messages that fail authentication.<\/li>\nfo=1<\/code> \u2014 Requests forensic reports when either SPF or DKIM fails.<\/li>\n<\/ul>\n<\/li>\np=none<\/code> for your first week. Review the aggregate reports to confirm legitimate emails are passing authentication, then increase the policy to p=quarantine<\/code> and eventually p=reject<\/code> for maximum protection.<\/p>\nVerifying Your Records Are Working<\/h2>\n
Using MXToolbox<\/h3>\n
\n
default._domainkey.yourdomain.com<\/code> as the selector and verify a public key is returned.<\/li>\nSending a Test Email<\/h3>\n
\n
Received-SPF: Pass<\/code><\/li>\nDKIM-Signature:<\/code> present and dkim=pass<\/code><\/li>\nAuthentication-Results:<\/code> showing dmarc=pass<\/code><\/li>\n<\/ul>\nfail<\/code> or neutral<\/code>, revisit your DNS records and double-check the values. A single typo in a TXT record can cause authentication to fail.<\/p>\nGoogle’s Postmaster Tools<\/h3>\n
Troubleshooting Common Issues<\/h2>\n
include<\/code> statement counts as one lookup. If you exceed the limit, SPF breaks silently. Consolidate multiple includes where possible or use a dedicated SPF management service.<\/p>\ndefault._domainkey<\/code>) does not match what your email client expects, DKIM validation fails. Check your email client’s documentation and add an additional DKIM record if needed.<\/p>\np=reject<\/code> without first monitoring your traffic, you may block legitimate emails from services like newsletter platforms or partner integrations that you forgot to authorize. Always start with p=none<\/code> and review reports for at least a week before moving to a stricter policy.<\/p>\nKey Takeaways<\/h2>\n
\n
_dmarc<\/code> subdomain format with a carefully chosen policy level.<\/li>\np=none<\/code> and review aggregate reports before tightening to p=quarantine<\/code> or p=reject<\/code>.<\/li>\n