Email Deliverability - SPF, DKIM & DMARC

Email deliverability is how likely your emails are to reach the recipient's inbox rather than their spam folder. Modern email providers (Gmail, Outlook, Yahoo) require proper authentication before they trust email from your domain. The three key technologies are SPF, DKIM, and DMARC.

Please note: Screens and options may vary slightly depending on your cPanel version and hosting plan.

Using the Email Deliverability Tool

cPanel includes a dedicated Email Deliverability tool that checks your configuration and suggests fixes.

1. Log in to your cPanel account.
2. In the Email section, click Email Deliverability.
3. You'll see a status for each domain. A green tick means the record is correctly configured. A warning triangle means action is needed.
4. Click Manage next to the domain to view details and install suggested records.

SPF (Sender Policy Framework)

SPF tells receiving mail servers which servers are authorised to send email on behalf of your domain. It's published as a TXT record in your DNS.

A typical SPF record looks like:

v=spf1 +a +mx +ip4:123.45.67.89 ~all

This means: allow the server's A record, MX servers, and the specified IP to send mail, and soft-fail everything else.

To fix or add an SPF record:

1. In the Email Deliverability tool, click Manage for the domain.
2. If an SPF record is missing or incorrect, cPanel will suggest the correct record.
3. Click Install the Suggested Record or Customise to edit manually.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your outgoing emails. The receiving server can verify this signature against a public key published in your DNS, confirming the message hasn't been tampered with.

To enable DKIM:

1. In the Email Deliverability tool, click Manage for the domain.
2. If DKIM is not configured, cPanel will provide the key and suggest a DNS record.
3. Click Install the Suggested Record.

DKIM records are TXT records on a subdomain like default._domainkey.yourdomain.com.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM. It tells receiving servers what to do when an email fails SPF and DKIM checks, and where to send reports about these failures.

A basic DMARC record looks like:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

• p=none — Take no action on failures (monitoring only). Good for initial setup.
• p=quarantine — Move failing messages to the spam folder.
• p=reject — Reject failing messages entirely.

To add a DMARC record:

1. Go to Zone Editor in cPanel.
2. Click Manage for the domain.
3. Click Add Record > Add "TXT" Record.
4. Set the Name to _dmarc.yourdomain.com.
5. Set the Record value to your DMARC policy (start with p=none while monitoring).
6. Click Save Record.

Recommended Setup Order

1. SPF — Set up first. This is the most basic requirement.
2. DKIM — Enable next. This confirms message integrity.
3. DMARC — Add last, starting with p=none to monitor, then tightening to p=quarantine or p=reject once you're confident legitimate email is properly authenticated.

Tips

• Always use the Email Deliverability tool to verify your records after making changes.
• If you use third-party services to send email (e.g. Mailchimp, SendGrid, Google Workspace), you'll need to include their servers in your SPF record and configure DKIM for each service.
• Monitor DMARC reports to identify unauthorised senders using your domain.
• Changes to DNS records can take up to 24–48 hours to propagate globally, though most changes take effect within an hour.

What Next?

• Managing DNS Records (Zone Editor) — Edit your DNS records directly.
• Understanding Email Routing (MX Records) — Ensure mail is routed to the correct server.

Related Articles

• Managing DNS Records (Zone Editor)
• Understanding Email Routing (MX Records)
• Common Email Error Messages Explained
• Tracing an Email Delivery (Track Delivery)