SPF, DKIM and DMARC are DNS records that prove email from your domain really came from you. Without them, your messages are more likely to land in spam, and it's easier for someone else to send email pretending to be you. This guide shows you how to check and set up all three.
Check and fix SPF and DKIM
- Log in to cPanel and go to Email › Email Deliverability.
- Find your domain in the list. If SPF and DKIM are set up correctly, the status shows as valid. If not, you'll see a warning.
- Click Manage next to the domain to see the suggested SPF and DKIM records next to what's currently published.
- If your domain uses our nameservers, click Repair (or Install the suggested record) and cPanel updates the DNS for you.
- If your DNS is hosted somewhere else, such as Cloudflare or your registrar, copy the suggested records from this page and add them at your DNS provider instead.
Add a DMARC record
DMARC tells receiving servers what to do with mail that fails SPF and DKIM checks, and can send you reports about it.
- In cPanel, go to Domains › Zone Editor and click Manage next to your domain.
- Click Add Record and choose TXT.
- For the name, enter
_dmarc.example.co.uk. - For the value, start with a monitoring-only policy:
v=DMARC1; p=none; rua=mailto:you@example.co.uk - Save the record.
Leave it on p=none for a few weeks and read the reports sent to the rua address. Once you're sure all your genuine mail passes, change it to p=quarantine, which asks receivers to send failing mail to spam.
Using Microsoft 365, Google Workspace or a mailing service
A domain can only have one SPF record, so every service that sends mail as your domain has to be included in that one record. For example:
- Microsoft 365: add
include:spf.protection.outlook.com - Google Workspace: add
include:_spf.google.com
Each provider also gives you its own DKIM record to add. Never create a second SPF record. Edit the existing one in the Zone Editor instead.
Check your work
DNS changes can take a while to spread. Once they have, run your domain through our email checker to confirm SPF, DKIM, DMARC and MX all look right. For more background, read SPF, DKIM and DMARC explained. If Outlook users see SPF failures when you send, see fixing Outlook outgoing server SPF failures.
