Short answer: In cPanel, open Email → Email Deliverability. If your DNS is hosted on the same server, click Repair next to the domain and SPF and DKIM are added automatically. If your DNS is elsewhere (for example Cloudflare), copy the suggested SPF and default._domainkey DKIM records there by hand. Add the _dmarc TXT record for DMARC in the Zone Editor or your DNS host.
The Email Deliverability tool
In current cPanel versions, the Email Deliverability tool in the Email section shows SPF, DKIM and reverse DNS (PTR) status for each domain.
- Valid: the record is correct; nothing to do.
- Problems exist: click Manage for details; the tool shows the suggested record.
- Repair: if DNS is managed on this server, fixes the record for you.
cPanel SPF record
cPanel's suggested SPF record usually looks like this:
| Type | Host / Name | Value |
|---|---|---|
| TXT | @ | v=spf1 +a +mx +ip4:SERVER_IP ~all |
If the same domain also uses Google Workspace or Microsoft 365, be careful before clicking Repair: cPanel may replace your existing record with its own suggestion. In that case, merge both sources into one record: v=spf1 +a +mx +ip4:SERVER_IP include:_spf.google.com ~all. The SPF record generator does this merge for you.
cPanel DKIM record
cPanel generates a DKIM key for each domain and uses the default selector:
| Type | Host / Name | Value |
|---|---|---|
| TXT | default._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkq... (value from Email Deliverability) |
If your DNS is at an external provider such as Cloudflare, copy this value from the Email Deliverability screen and add it there. Our checker tries the default selector automatically.
Reverse DNS (PTR) warning
If Email Deliverability reports a PTR problem, it's your hosting provider, not you, who has to fix it: the server IP's reverse record must match the name the server uses when sending mail. Missing PTR is a frequent cause of Gmail's temporary 421 4.7.0 rejections. On shared hosting, another account on the same IP sending spam can also get the IP blocklisted.
DMARC record for cPanel hosting
DMARC is added directly in DNS, independent of your mail provider. Once SPF and DKIM work, start with this record:
| Type | Host / Name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
p=nonefor 1-2 weeks: the aggregate reports show every source sending mail as your domain. If anything besides cPanel hosting sends for you (invoicing, CRM, newsletter tool), add it to SPF/DKIM too.p=quarantine: mail that fails authentication goes to the recipient's spam folder.p=reject: mail that fails is refused outright. This is the strongest protection against spoofing of your domain.
Use a dedicated mailbox for the report address (rua); reports are XML files and arrive frequently. Gmail, Yahoo and Microsoft all require at least p=none from bulk senders.
How to verify the setup
- Enter your domain in the SPF, DKIM, DMARC checker and make sure all three records show green.
- Send a test message to a Gmail address, open it and choose ⋮ → Show original. You should see
PASSfor SPF, DKIM and DMARC. - Paste the headers into the email header analyzer to read the details in a friendly format.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
I can't see the Email Deliverability menu.
Your host may have disabled the feature, or runs an older cPanel version. Add the records manually in the Zone Editor and ask your host for the DKIM value.
My mail is on Google Workspace but my website is on cPanel. What goes in SPF?
Combine both in one record: v=spf1 +a +mx include:_spf.google.com ~all. The +a +mx part is needed if your website's contact form sends mail through the cPanel server.