If you’ve ever been told your emails are landing in spam, or you’re setting up a new domain for email, you’ve likely come across SPF, DKIM and DMARC. These three DNS records work together to prove your emails are legitimate and to tell receiving mail servers what to do if they’re not. Here’s what each one does.
SPF (Sender Policy Framework)
SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When another mail server receives a message claiming to be from your domain, it can check your SPF record to see if the sending server is on the approved list.
A generic example looks like this:
v=spf1 include:_spf.example.com ~allThe include: section names the mail servers you’re authorising, and ~all tells receiving servers to treat mail from unlisted servers with suspicion rather than rejecting it outright. Use the actual values provided in your own cPanel Email Deliverability tool rather than this placeholder, since the correct include values depend on your specific mail setup.
DKIM (DomainKeys Identified Mail)
DKIM works differently. Instead of listing approved servers, it attaches a digital signature to each outgoing email, generated using a private key. The corresponding public key is published in your DNS as a DKIM record, so receiving servers can verify that the signature is valid and that the message hasn’t been altered in transit.
A DKIM record is typically a long, unique string of characters tied to a selector (a name used to identify which key was used), and it’s specific to your mail server, so it isn’t something you can write from a generic template. It needs to be generated for your domain and published exactly as provided.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties SPF and DKIM together. It’s a policy record that tells receiving mail servers what to do if a message fails SPF or DKIM checks, and optionally where to send reports about that activity.
A generic example looks like this:
v=DMARC1; p=none; rua=mailto:reports@example.comThe p= tag sets the policy: none monitors without taking action, quarantine sends failing mail to spam, and reject blocks it outright. Many domain owners start with p=none while they confirm SPF and DKIM are working correctly, then move to a stricter policy over time. As with SPF, use the values generated for your own domain rather than copying this example directly.
How to add these records in cPanel
The easiest way to set all three up correctly is through cPanel’s built-in tool rather than writing records from scratch:
- Log in to your cPanel account.
- Navigate to the Email section and open Email Deliverability.
- Find your domain in the list and check its status. cPanel will show you whether SPF, DKIM and DMARC are already correctly configured.
- If any records are missing or incorrect, click to view the recommended DNS entries. cPanel generates the correct DKIM key and suggested SPF and DMARC records for your specific mail setup.
- If your domain’s DNS is hosted with us, cPanel can add these records automatically. If your DNS is managed elsewhere, copy the exact values shown and add them as DNS records with your DNS provider.
- Recheck the Email Deliverability status after making changes to confirm everything is correctly configured.
Why it’s worth setting up properly
Correctly configured SPF, DKIM and DMARC records make it harder for someone else to send fraudulent email that appears to come from your domain, and they give receiving mail servers more confidence that your genuine emails are legitimate, which can help with delivery to the inbox rather than the spam folder.
Next steps
Need help with email on your domain? Learn more about email included with your hosting on our email hosting page.