SPF, DKIM and DMARC are DNS records that show your mail really comes from you. Without them, more of your mail lands in spam or is rejected. This guide explains each one and how to set them up in cPanel.
SPF
SPF lists the servers allowed to send mail for your domain. In cPanel, Email Deliverability shows your SPF record and can install the one it suggests. A simple record looks like this:
v=spf1 +a +mx ~allIf other services send mail as you, such as a newsletter tool, add them with include:, using the value they give you. Your domain must have only one SPF record, so combine everything into it.
DKIM
DKIM adds a digital signature to each message. The receiving server checks it against a public key in your DNS. cPanel creates the key for you: in Email Deliverability, check that DKIM shows as valid, and select Repair if it doesn't. The record lives at default._domainkey.yourdomain.co.za.
DMARC
DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports. Add it as a TXT record named _dmarc in the Zone Editor. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.co.zaWhen the reports show your real mail passing, change p=none to p=quarantine, and later to p=reject.
Test your setup
- Send a message to Gmail and use Show original to check that SPF, DKIM and DMARC say PASS.
- Use mail-tester.com for a score.
- Use MXToolbox to look up each record.
Common mistakes
- Two SPF records. This makes SPF fail. Merge them into one.
- Using
-alltoo early. Start with~alluntil you're sure every sender is listed. - Forgetting DKIM after a move. When you move your domain to us, the DKIM key changes. Check Email Deliverability after the move.
- Going straight to
p=reject. Runp=nonefirst and read the reports.
Related guides
- How to set up email on your own domain
- Email troubleshooting: not receiving or not sending
- How to manage DNS records in cPanel
- How to create and manage email accounts in cPanel
Stuck? Open a ticket and a person will reply.
