Set up SPF, DKIM and DMARC in cPanel Email Deliverability

Gmail, Outlook and other large providers check three DNS records before they trust your mail: SPF, DKIM and DMARC. Without them, messages from your cPanel server often land in spam or get rejected. cPanel's Email Deliverability page checks SPF and DKIM for each domain and can fix them with one click. This guide covers those fixes, adding DMARC, and the reverse DNS check.

Before you start

• A cPanel login, or root access to WHM for all domains.
• Know where each domain's DNS is hosted. If it uses your server's nameservers, cPanel can install records itself. If DNS is elsewhere (a registrar or CDN), you copy the records there by hand.
• A list of other services that send mail as your domain, such as a newsletter tool or a Google Workspace account.

What each record does

• SPF: a TXT record listing which servers may send mail for the domain.
• DKIM: a public key in DNS. Your server signs outgoing mail with the matching private key, so receivers can check the message was not altered.
• DMARC: a TXT record at _dmarc.example.com that tells receivers what to do when SPF and DKIM fail, and where to send reports.

Check the domain in Email Deliverability

1. In cPanel, open Email » Email Deliverability. (Root can use WHM » Email » Email Deliverability for all accounts.)
2. Each domain shows a status. Problems Exist means SPF, DKIM or reverse DNS needs attention.
3. Click Manage next to the domain.

The page has sections for DKIM, SPF and Reverse DNS (PTR), each with the current state and the suggested record.

Repair DKIM

In the DKIM section, if the record is missing or wrong, click Install the Suggested Record (or Repair). cPanel adds a TXT record named default._domainkey.example.com containing the public key.

If your DNS is hosted elsewhere, copy the Name and Value shown and create the same TXT record at your DNS provider.

Repair SPF

In the SPF section, click Install the Suggested Record (or Repair). A typical cPanel SPF record looks like:

v=spf1 +a +mx +ip4:203.0.113.10 ~all

If other services send mail for the domain, add their includes before ~all. There must be only one SPF record per domain. If you already have one, merge the values instead of adding a second TXT record. Use the Customize option if you need extra hosts.

Add a DMARC record

Email Deliverability focuses on SPF and DKIM. Add DMARC yourself in the Zone Editor:

1. Open Domains » Zone Editor and click Manage next to the domain.
2. Click Add Record. Some versions offer a DMARC type in the record menu; otherwise choose TXT.
3. Name: _dmarc.example.com.
4. Value, to start in monitoring mode:

   v=DMARC1; p=none; rua=mailto:dmarc@example.com

1. Save the record.

p=none only collects reports. After a few weeks of reports show your real mail passes, move to p=quarantine and later p=reject.

Check reverse DNS (PTR)

The Reverse DNS (PTR) section shows whether your server IP points back to a name that resolves to the same IP. cPanel cannot change this itself; the PTR belongs to whoever runs the IP range. See reverse DNS for cPanel mail servers for how to request and test it.

Check it works

Query the records from any computer:

dig +short TXT example.com | grep spf1
dig +short TXT default._domainkey.example.com
dig +short TXT _dmarc.example.com

Each should return your record. Then send a message to a Gmail account, open it, choose Show original, and confirm SPF: PASS, DKIM: PASS and DMARC: PASS. Finally, reload Email Deliverability; the domain should show as valid.

Troubleshooting

• Still "Problems Exist" after repair: DNS is hosted elsewhere, so cPanel's change does not reach the internet. Copy the records to the real DNS provider.
• DKIM fails at Gmail: the key at your DNS provider was split or truncated. Paste the full value again as one record.
• SPF "permerror": there are two SPF records or too many lookups. Merge into one record.
• DMARC fails although SPF passes: the visible From domain does not match the domain SPF checked. Make sure DKIM signs with your domain.

Next steps

• Get the PTR record right: reverse DNS for cPanel mail.
• Edit records by hand: cPanel Zone Editor.
• Diagnose rejected mail: fix cPanel email not sending.