SPF, DKIM and DMARC in cPanel: Stop Emails Landing in Spam

You send an important quotation to a client, and they find it a day later in their spam folder, or never at all. Very often the cause is not your message but missing email authentication records on your domain.

In this guide we explain SPF, DKIM and DMARC in simple words and show you how to set up all three in cPanel using Email Deliverability and the Zone Editor.

Why authentication matters

Anyone can write any “From” address on an email, which is exactly how spammers and fraudsters pretend to be banks or businesses. To fight this, large mail providers such as Gmail, Outlook and Yahoo check whether a message really comes from a server the domain owner has approved. Google and Yahoo now expect senders to have proper authentication in place, and mail from domains without it is far more likely to be filtered or rejected.

Three DNS records do this job together:

Record	What it does	Simple analogy
SPF	Lists the servers allowed to send mail for your domain	A guest list at the gate
DKIM	Adds a digital signature that proves the message was not changed	A tamper-proof seal on an envelope
DMARC	Tells receivers what to do if SPF or DKIM fails, and sends you reports	The security guard’s instructions

Before you start: where is your DNS?

These records live in your domain’s DNS. cPanel can only change them if your domain uses your hosting company’s nameservers. If your DNS is managed elsewhere, for example at your domain registrar or a service like Cloudflare, cPanel will still show you the correct records, but you must copy them into that other DNS panel yourself.

You can check this quickly: if Email Deliverability warns that the server is not authoritative for the domain, your DNS is hosted somewhere else.

Step 1: Check Email Deliverability

1. Log in to cPanel and open Email Deliverability in the Email section.
2. You will see a list of your domains with a status such as Valid or Problems Exist.
3. Click Manage next to the domain you want to fix.
4. The page shows separate panels for DKIM, SPF and Reverse DNS (PTR), each with the current record and a suggested record.

Step 2: Set up DKIM

cPanel creates a DKIM key pair for each domain. The private key stays on the server and signs every outgoing message. The public key is published in DNS so receivers can verify the signature.

1. On the Manage page, look at the DKIM panel.
2. If it shows a problem, click Install the suggested record.
3. If your DNS is hosted elsewhere, copy the Name (usually default._domainkey.example.com) and the long Value starting with v=DKIM1; k=rsa; p=, and add it as a TXT record at your DNS provider.

Tip: When copying the DKIM value to another DNS provider, copy it exactly, with no extra spaces or line breaks. A single missing character breaks the signature.

Step 3: Set up SPF

An SPF record is a TXT record on your main domain. A typical cPanel suggestion looks like this:

v=spf1 +a +mx +ip4:203.0.113.10 ~all

This means: mail may come from the domain’s own A record, its MX servers and the listed server IP. The ~all at the end says other senders should be treated as suspicious (“soft fail”).

1. In the SPF panel, review the suggested record.
2. If you also send mail through other services, such as Google Workspace, Microsoft 365, or a newsletter or invoicing tool, add their include: values before ~all. Each service publishes the exact value in its own help pages.
3. Click Install the suggested record, or Customize to add extra entries first.

The golden rules of SPF

• Only one SPF record per domain. Two records starting with v=spf1 cause SPF to fail. Merge them into one.
• Stay under 10 DNS lookups. Every include:, a and mx counts towards this limit. Too many and SPF breaks.
• Do not use +all. It allows the whole internet to send as you.

Step 4: Check Reverse DNS (PTR)

The same page shows whether your server’s IP address has a matching reverse DNS (PTR) record. This is controlled by your hosting company, not by you. On shared hosting it is normally already correct. If it shows a problem, contact support.

Step 5: Add a DMARC record

Depending on your cPanel version, Email Deliverability may not create DMARC for you, so the reliable way is the Zone Editor.

1. Open Zone Editor in the Domains section.
2. Click Manage next to your domain.
3. Click + Add Record and choose TXT as the type.
4. In Name, enter _dmarc.example.com. (replace with your domain).
5. In Record, enter a starting policy such as:

   v=DMARC1; p=none; rua=mailto:dmarc@example.com

6. Click Save Record.

The rua address receives daily summary reports from big mail providers. Create a mailbox or forwarder for it first, because the reports can be frequent.

Choosing a DMARC policy

Policy	What receivers do with failing mail	When to use
p=none	Deliver as normal, but report it	First few weeks, while you check reports
p=quarantine	Send it to spam	Once all your real mail passes
p=reject	Refuse it completely	Strongest protection against spoofing

Start with p=none. If the reports show all your genuine mail passing SPF or DKIM, move to quarantine and later to reject. Jumping straight to reject can block your own invoices or newsletters sent through a service you forgot to add to SPF.

Step 6: Test your setup

DNS changes can take anything from a few minutes to several hours to update. Once they have, test with a real message:

1. Send an email from your cPanel mailbox to a personal Gmail address.
2. Open the message in Gmail on a computer, click the three-dot menu and choose Show original.
3. Look for SPF: PASS, DKIM: PASS and DMARC: PASS near the top.

Back in cPanel, Email Deliverability should now show Valid for the domain.

Common problems and fixes

SPF fails even though the record exists

Check for duplicate SPF records in Zone Editor or at your external DNS provider and merge them. Also confirm the sending service is included.

DKIM shows “invalid” on an external DNS provider

The value was probably cut or had spaces added while copying. Delete it and paste it again carefully. Some providers want the name as just default._domainkey without your domain on the end.

Mail still goes to spam with all three passing

Authentication is necessary but not the whole story. Avoid spammy subject lines, do not send to purchased lists, include a clear signature, and let a new domain build its reputation gradually.

Mail from a website contact form fails

Make sure the form sends from an address on your own domain and through your hosting server, ideally using SMTP authentication via a plugin.

Frequently asked questions

Do I need all three records?

Yes. SPF and DKIM prove the mail is genuine, and DMARC ties them to your visible “From” address. Together they give the best chance of reaching the inbox.

Will this stop people faking my domain?

Once DMARC is set to quarantine or reject, most major providers will block or filter spoofed mail claiming to be from your domain.

Does this cost anything?

No. These are free DNS records, and the tools are already in cPanel. You do not need to spend a single ₹ extra.

I use Google Workspace for email. Should I still use Email Deliverability?

Use the DKIM key from your Google admin console instead of the cPanel one, and make sure your SPF includes Google’s servers. cPanel’s suggestions assume mail is sent from your hosting server.

Conclusion

SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receivers what to do when something does not match. In cPanel, Email Deliverability handles SPF and DKIM in a couple of clicks, and the Zone Editor adds DMARC. Set them up once, test with Gmail’s “Show original”, and your emails will have a much better chance of landing in the inbox.