Set up DKIM, SPF and DMARC in DirectAdmin

Large mail providers reject or spam-folder messages that are not authenticated. DirectAdmin can sign outgoing mail with DKIM and creates SPF records automatically; you add DMARC to complete the setup. Together they prove that mail from your domain really comes from your server.

Before you start

• Mail for the domain is sent from the DirectAdmin server.
• Know whether DNS is hosted on the server (DNS Management works) or externally (Cloudflare, registrar).
• Admins: DKIM must be enabled server-wide (it is on by default on current versions; otherwise set dkim=1 in directadmin.conf and rebuild Exim with CustomBuild).

Enable DKIM for the domain

1. Log in and select the domain.
2. Go to E-Mail Manager → DKIM Keys (or Domain Setup → domain → DKIM).
3. Click Enable DKIM. DirectAdmin generates a key pair and adds a TXT record named x._domainkey to the zone.

Check SPF

Open Account Manager → DNS Management and find the root TXT record beginning with v=spf1. A typical DirectAdmin value is v=spf1 a mx ip4:203.0.113.10 ~all. Add any other senders, such as include:_spf.google.com or your newsletter service, keeping a single SPF record. See DNS management.

Add DMARC

1. In DNS Management click Add Record.
2. Type TXT, name _dmarc, value:

v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1

Start with p=none to collect reports, then move to p=quarantine and p=reject once reports show your legitimate mail passes.

External DNS

If your nameservers are elsewhere, copy the records: open DNS Management on DirectAdmin (it still shows the local zone), copy the full value of x._domainkey, the SPF TXT and the DMARC TXT, and create identical records at your DNS provider. Long DKIM values must be pasted as one record without line breaks.

Verify

• Send a message to a Gmail address, open it and choose Show original. SPF, DKIM and DMARC should all show PASS.
• Query DNS: dig TXT x._domainkey.example.com +short.

Also check reverse DNS

The server's IP should have a PTR record matching its hostname. On a VPS, see set rDNS in Virtualizor. Without it, even authenticated mail may be rejected.

Troubleshooting

• DKIM menu missing: DKIM is disabled server-wide; ask the administrator.
• DKIM fails: the public key at external DNS is truncated or outdated after regenerating keys.
• SPF permerror: two SPF records or too many DNS lookups.
• Mail still in spam: check content, blacklists and sending volume; see Exim queue troubleshooting.

Next steps

• Email accounts in DirectAdmin.
• Forwarders and spam filters.
• The same setup in Plesk.