Gmail, Outlook and Yahoo now reject or spam-folder mail from domains without proper authentication. As a reseller, you can check every customer domain's SPF and DKIM records in WHM and fix them with one click, instead of editing DNS by hand.
Before you start
- WHM access on your reseller plan.
- The domain must use the server's nameservers (or your private nameservers). For domains on external DNS, you will copy the suggested records to that provider.
Check a domain in WHM
- Log in to WHM.
- Go to WHM → Email → Email Deliverability.
- The list shows each domain with a status: valid, or a warning icon for DKIM, SPF or PTR problems.
- Click Manage next to a domain to see details.
Repair SPF and DKIM
- On the domain's page, read the Suggested "SPF" (TXT) Record and DKIM sections.
- If the server controls the DNS, click Repair or Install the suggested record.
- If the domain uses external DNS, copy the suggested record and add it at the DNS provider.
- Click Re-check after a few minutes.
Note: A domain may have only one SPF record. If the customer also sends via Google Workspace, Mailchimp or another service, merge the includes into one record, for example v=spf1 +a +mx include:_spf.google.com ~all.
PTR (reverse DNS) warnings
The PTR check confirms the server's sending IP resolves back to the hostname. This is set by MdmHost for shared IPs. If you see a PTR warning, open a support ticket; it is not something you can change as a reseller. Learn more in what reverse DNS is.
Add a DMARC record
WHM does not create DMARC automatically. Add a TXT record in Zone Manager:
- Name:
_dmarc.example.com. - Type: TXT
- Value:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Start with p=none to collect reports, then move to p=quarantine once all legitimate senders pass.
Protect the shared IP
All customers on a server share the sending IP. One compromised WordPress contact form can get it listed and hurt everyone's delivery. Keep sensible limits (see limiting outgoing email per account) and scan sites for malware with Imunify360.
Test after the changes
- Send a test message to a Gmail address and open Show original. SPF, DKIM and DMARC should all say PASS.
- In the customer's cPanel, Email → Track Delivery shows whether messages were accepted by the remote server.
Troubleshooting
"DKIM: the record does not match"
The domain has an old DKIM key at an external DNS provider. Replace it with the current one from WHM.
Mail still goes to spam with all checks passing
Content and reputation matter too. Avoid link-only messages, use a proper From name and ask recipients to mark mail as not spam. Bulk newsletters should use a dedicated sending service.
Status shows SPF "too many DNS lookups"
SPF allows a maximum of 10 lookups. Remove unused include: entries.
Frequently asked questions
Do customers need to do anything?
Not if their domain uses your nameservers; your repair applies to their zone. Customers can also check their own domain in cPanel → Email → Email Deliverability.
Is ~all or -all better?
Use ~all (soft fail) together with DMARC. A hard -all can cause legitimate forwarded mail to be rejected.
Does DKIM need the same key on all domains?
No. Each domain gets its own DKIM key, generated by the server when the account is created.