SPF, DKIM and DMARC in cPanel
cPanel checks each domain’s SPF and DKIM in “Email Deliverability” and suggests the right records. If the server manages the DNS, it installs them in one click; if not, you copy them to your DNS provider. You add DMARC yourself.
What to publish
@ (the domain)The one cPanel suggests (“Suggested SPF record”), with your server.
If you also send from other services, their include: go in the same record.
default._domainkeyThe one cPanel suggests (“Suggested DKIM record”).
Usually with the default selector; publish the one your panel shows.
_dmarcv=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Through Zone Editor if your cPanel version does not offer it in Email Deliverability.
Step by step
- cPanel > Email section > Email Deliverability.
- Find your domain: if there are problems, press “Manage” to see the current and the suggested SPF and DKIM records.
- If the server manages the DNS, “Repair” (or “Install the suggested record”) installs them. If the domain uses other name servers (Cloudflare, your registrar…), that option is not available: copy the suggested records to your DNS provider.
- Add the DMARC record under Domains > Zone Editor (or in your external DNS): type TXT, name
_dmarc.
Usual mistakes
- Pressing Repair when the DNS is not on the server: nothing changes where it matters.
- Keeping an old SPF record from another provider next to the suggested one: there must be only one.
- Taking DKIM for granted: if the record is not published in the DNS that counts, the signature cannot be verified.
Towards p=reject
DMARC at p=none only watches. The reports (rua) show who sends on your behalf; once all your legitimate mail passes aligned SPF or DKIM, move to quarantine and then to reject. That way, nobody can use your domain to send forged mail.
Check your domain
Sources
Checked on 24 September 2026. Panels change: if something does not match, the provider’s documentation wins.