How to set up SPF, DKIM and DMARC in cPanel

What SPF, DKIM and DMARC each do

Since February 2024, Gmail and Yahoo require every sender to pass SPF or DKIM, and anyone sending around 5,000 or more messages a day to their users to have SPF, DKIM and DMARC (at least p=none), with the From domain aligned to one of them, plus one-click unsubscribe on marketing mail and a spam-complaint rate under 0.3%. Microsoft applied similar rules to Outlook.com and Hotmail in May 2025. Even if you send far less, mail with all three records is treated as more trustworthy.

Step 1: Open Email Deliverability in cPanel

Go to cPanelEmailEmail Deliverability. Every domain on the account is listed with its status. Valid means SPF and DKIM are both published correctly; Problems Exist means at least one is missing or doesn't match the server.

cPanel›Email›Email Deliverability

DomainStatusActions

yourdomain.inValidManage

yourshop.co.inProblems ExistRepair · Manage

If your DNS is in cPanel, Repair publishes both suggested records in one click. If your DNS is elsewhere, cPanel can't change it: open Manage, copy the suggested values and add them at your DNS provider, as in the next two steps.

Step 2: Publish one SPF record that lists every sender

Under Manage, the SPF section shows a suggested record for your hosting server. If cPanel is the only thing that sends your mail, click Install the suggested record, or add it at your DNS provider as a TXT record on @:

; mail sent only from your VirtualCloud hosting
@   3600  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.24 ~all"

If other services send as your domain too, add their include: to the same record. Use Customize in the SPF section, or edit the TXT record directly:

; website forms from your hosting + staff mail on Google Workspace
@   3600  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.24 include:_spf.google.com ~all"

• One record only. Two TXT records that both start with v=spf1 make SPF fail for everything.
• Ten lookups at most. Each include:, a and mx costs at least one; ip4: costs none. Remove services you no longer use.
• End with ~all while you set things up. Once DMARC is enforcing, -all adds little, so most domains can stay on ~all.

Step 3: Turn on DKIM signing

cPanel generates a 2048-bit key for every domain and signs outgoing mail with it. The public half must be in DNS as a TXT record named default._domainkey. In the DKIM section of Manage, click Install the suggested record, or copy the name and value to your DNS provider:

default._domainkey  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"

Copy the value in one go: a single missing character breaks the signature. Some DNS panels split long values into several quoted strings, which is fine. Other services sign with their own keys and selectors, so each needs its own record next to cPanel's:

• Google Workspace: in the Admin console, open AppsGoogle WorkspaceGmailAuthenticate email, generate a record (selector google), add it as TXT on google._domainkey, then click Start authentication.
• Microsoft 365: add the two CNAME records selector1._domainkey and selector2._domainkey shown in the Microsoft Defender portal's DKIM settings, then enable signing there.
• Newsletter and CRM tools: look for "domain authentication" in their settings. They usually give you DKIM CNAMEs rather than an SPF include.

Step 4: Add a DMARC record in monitoring mode

cPanel doesn't create DMARC for you. In cPanelDomainsZone Editor, click Manage next to the domain, choose Add Record, set the type to TXT, the name to _dmarc and the value below (or add the same at your DNS provider):

_dmarc  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

p=none changes nothing about delivery. It asks Gmail, Yahoo, Microsoft and others to send a daily XML summary to the rua address, listing every server that sent mail as your domain and whether it passed. Those reports are how you find the billing tool or old website form you forgot about, before a strict policy blocks it.

Step 5: Tighten DMARC from none to quarantine to reject

Move on only when the reports show every genuine sender passing SPF or DKIM with your domain. Fix any that don't by adding their include or DKIM record, then wait another week of clean reports.

; stage 2: failing mail goes to spam
_dmarc  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
; stage 3: failing mail is refused, subdomains included
_dmarc  3600  IN  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]"

Edit the existing _dmarc record each time rather than adding a second one. If something legitimate starts failing, step back to the previous policy; nothing is lost while you investigate.

Test SPF, DKIM and DMARC

Send a message from your domain to a Gmail address, open it, and choose Show original from the three-dot menu. The summary at the top should read SPF: PASS, DKIM: PASS and DMARC: PASS. To check what's published, look up type TXT in our DNS lookup tool, or from a terminal:

dig +short TXT yourdomain.in
dig +short TXT default._domainkey.yourdomain.in
dig +short TXT _dmarc.yourdomain.in

New records can take up to their TTL to appear everywhere; How to check DNS propagation explains the wait.

SPF, DKIM and DMARC troubleshooting