SPF, DKIM, and DMARC in cPanel-email authentication
Enable DKIM signing, check your SPF record, and add a DMARC policy in cPanel. Correct email authentication improves deliverability and prevents spoofing.
UnderHost NOC
Network Operations
On this page
SPF, DKIM, and DMARC are DNS-based email authentication standards. Together they tell receiving mail servers that your email is legitimate, which significantly improves deliverability and protects your domain from being spoofed by spammers.
Why these records matter
| Record | What it does |
|---|---|
| SPF | Lists the IP addresses and mail servers that are authorised to send email for your domain. Prevents anyone outside that list from claiming to send as you. |
| DKIM | Adds a cryptographic signature to every outgoing email. The receiving server checks the signature against a public key in your DNS. Tampered or forged messages fail the check. |
| DMARC | Tells receiving servers what to do with messages that fail SPF or DKIM-report, quarantine, or reject. Also generates reports so you can see if anyone is spoofing your domain. |
All three are TXT records in your domain's DNS zone. If your nameservers point to UnderHost, you manage them in cPanel Zone Editor or via the Email Deliverability tool.
Enable DKIM in cPanel
cPanel can generate and publish DKIM keys automatically:
- Go to Email → Email Deliverability
- Find your domain in the list
- If DKIM shows a warning, click Repair next to the DKIM row-cPanel will generate a key pair and publish the public key as a DNS TXT record automatically
- Wait a few minutes, then reload the page. DKIM should now show as Valid
If your nameservers are not pointing to UnderHost (e.g., you use Cloudflare for DNS), cPanel will show the DKIM TXT record value but cannot add it automatically. Copy the record and add it manually at your DNS provider.
SPF record
cPanel automatically creates an SPF record when a domain is added. Check it via Email → Email Deliverability. If SPF shows as invalid or missing:
- In Email Deliverability, click Repair next to SPF to have cPanel regenerate the correct record
- If managing DNS externally, use this standard SPF TXT record on your domain's root (
@):
v=spf1 include:spf.underhost.com ~allIf you also send email via Google Workspace, Mailchimp, or another service, their sending infrastructure must be included in the SPF record too:
v=spf1 include:spf.underhost.com include:_spf.google.com ~allA domain can only have one SPF TXT record. If you have multiple SPF records, most receivers will reject both. Combine all include statements into a single record. Having two separate SPF TXT records is a common misconfiguration.
DMARC policy
DMARC is not automatically created by cPanel. Add it manually as a TXT record on _dmarc.yourdomain.com:
| Policy | TXT record value | Effect |
|---|---|---|
| Monitor only | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com | No action taken; reports sent to your address |
| Quarantine | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com | Failing messages go to spam folder at receiver |
| Reject (strict) | v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com | Failing messages are rejected outright |
Start with p=none to monitor without affecting delivery. After reviewing the reports for a few weeks and confirming your legitimate mail passes, move to p=quarantine and eventually p=reject.
To add this in cPanel: go to Domains → Zone Editor → Manage the domain → Add a TXT record with name _dmarc and the value above.
Verify your records
After making changes, use the UnderHost Email Check tool to verify your SPF, DKIM, and DMARC records are resolving correctly. DNS changes can take up to 48 hours to propagate globally, though usually faster.
Common issues
p=none, failures are only reported-not acted on. The failures in reports may be from automated systems (mailing lists, forwarding services) that do not re-sign DKIM. Review which sources are failing before moving to a stricter policy.Related: Email routing and MX records in cPanel | Managing DNS records with cPanel Zone Editor | Email blacklists-check and delist your IP or domain | How to create and manage email accounts in cPanel | Email not sending-troubleshooting outgoing email
Need cPanel hosting or licensing?
Use UnderHost cPanel hosting or add cPanel/WHM to a VPS or dedicated server for familiar website, email, DNS, and database management.
