How to Set Up SPF, DKIM and DMARC in cPanel

SPF, DKIM and DMARC are DNS records (settings for your domain that the internet reads). They prove your email really comes from you, so it’s less likely to land in spam or be faked.

• SPF lists the servers allowed to send email for your domain.
• DKIM adds a digital signature to each message so the receiver can check it wasn’t changed.
• DMARC tells receivers what to do when a message fails those checks, and where to send reports.

Step 1: Set up DKIM

Open a support ticket and ask us to set up DKIM for your domain. If your DNS is elsewhere, ask for the record to add there.

If your cPanel has Email Deliverability (search for it), open it and click Manage next to your domain:

1. If DKIM shows no problem, go to Step 2.
2. If the domain has no DKIM key yet, click Generate Local DKIM Key.
3. If the DKIM section shows a suggested record, go back to the table and click Repair next to your domain. Check its SPF suggestion too (see Step 2) before you confirm.

Never share your private DKIM key with anyone.

Step 2: Set up SPF

1. List each outside service that sends your mail, with the include: value from its help pages, such as include:_spf.google.com for Google Workspace.
2. In cPanel, click Websites in the sidebar, click Manage next to your domain, and open the DNS tab. If you see a Zone Editor icon instead, click it, then Manage next to your domain. Or type DNS in cPanel’s search box (Ctrl+K or Cmd+K).
3. Take a screenshot of the TXT record that starts with v=spf1.
4. If nothing is missing, go to Step 3.
5. Edit the record and put each missing include: just before the ~all at the end. Don’t change ~all to -all; that makes mail from any service you missed fail. Save it.

No v=spf1 record, or can’t find the DNS tab? Open a support ticket listing your services, and ask us to set up SPF.

Step 3: Add one DMARC record

Wait 2 days after Steps 1 and 2. DMARC needs working SPF and DKIM first.

1. Create a mailbox at your own domain for reports, such as dmarc@yourdomain.com. Reports can arrive daily, so use a separate mailbox.
2. Open your domain’s DNS tab, as in Step 2. If you can’t, send us the DMARC record you want in a support ticket.
3. Look for a record named _dmarc. If one already exists, don’t add another. With two, receivers ignore DMARC.
4. If there’s none, add a new TXT record.
5. For its name, enter _dmarc.
6. For its value, paste v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com and change the address to your real report mailbox.
7. Save the record.

p=none only asks receivers for reports; they take no action yet. Reports are technical files, so a DMARC report reader helps.

Step 4: Tighten DMARC later

1. After at least a few weeks of reports showing all your real mail passing, edit the _dmarc record on the DNS tab and change p=none to p=quarantine.
2. Once quarantine has run without problems, change it to p=reject.

How to tell it worked

1. The DNS tab shows one v=spf1 record and one _dmarc record.
2. Send an email from your domain address to a Gmail address. In Gmail, open it, click More next to Reply, then Show original. Near the top, SPF, DKIM and DMARC should each show a pass.
3. DMARC reports start arriving within a day or two.

Troubleshooting

• You can’t find Email Deliverability or the DNS tab: open a support ticket.
• cPanel says it can’t change the records: your DNS is elsewhere. Add the suggested values there.
• A service says you have more than one SPF record: merge them into one TXT record that starts with v=spf1 and delete the others.
• A checker says SPF has too many lookups: remove services you no longer use, or open a support ticket.
• Reverse DNS (PTR) shows a problem: you can’t change it in cPanel. Open a support ticket and mention it.

Still need help?

Open a support ticket from the Client Portal at my.bluearctic.com. Include your domain, a screenshot of your DNS records, the services that send your mail, the exact error text, and what you already tried. Never include a password.