SPF and DMARC for your domain: a step-by-step setup in cPanel
PrintThree DNS records tell a receiving server that a message really comes from your domain. Without them your mail is filtered more often, and it is easier for someone else to send forged messages with your address. In cPanel, SPF and DKIM are handled in Email Deliverability; DMARC is a separate TXT record that you add yourself.
What each record does
| Record | Purpose | Where you set it |
|---|---|---|
| SPF | Lists the servers allowed to send mail for the domain | Email Deliverability |
| DKIM | A digital signature showing the message was not altered on the way | Email Deliverability |
| DMARC | Tells receivers what to do with mail that fails SPF or DKIM | Zone Editor, as a TXT record |
Step 1. SPF and DKIM through Email Deliverability
- In cPanel, go to the Email section and choose Email Deliverability.
- Find your domain in the list. If a problem is reported next to it, click Manage.
- The domain page shows the SPF record and DKIM key that cPanel recommends for the server your account is on.
- Click Repair and cPanel writes the correct values into the DNS zone for you.
Repair only works when the domain uses the TopHost nameservers (ns4.tophost.md and ns5.tophost.md). If your DNS is managed elsewhere, for example at Cloudflare or at your registrar, copy the values from cPanel into that provider's zone exactly as shown. Do not type an SPF record from memory or borrow one from another domain: the right value for your account is the one Email Deliverability displays.
More on DKIM: How to manage DKIM records in cPanel.
If other services send mail for you too
A newsletter platform, a CRM or an online shop that sends from your domain has to be included in SPF. The key rule: a domain has exactly one SPF record, meaning one TXT record starting with v=spf1. Never add a second one. Take the part the service asks you to add from its documentation and insert it into your existing record, before the closing ~all or -all.
Keep an eye on complexity as well. SPF allows no more than 10 extra DNS lookups, and a record that goes over that limit is treated as invalid, so test again after adding several services.
Step 2. Add the DMARC record
- First create a mailbox for the reports, for example
dmarc@your-domain.md, in the Email Accounts page of the Email section. If the mailbox does not exist, the reports bounce. - Open Domains, then Zone Editor, and click Manage next to the domain.
- Add a TXT record with the name
_dmarc(cPanel fills in the rest of the name with your domain). - As a starting value, use:
v=DMARC1; p=none; rua=mailto:dmarc@your-domain.md - Save. The general steps for TXT records are in How to add and remove TXT records in cPanel.
Choosing a DMARC policy
p=none: receivers change nothing and just send you reports. This is where you start.p=quarantine: failing mail is treated as suspicious and usually goes to Spam. Move here once the reports show that all your genuine sources pass.p=reject: failing mail is refused. Only use it when you are confident you know every service that sends for the domain.
A careful path is a few weeks on p=none, then p=quarantine, then p=reject. Jumping straight to reject can block legitimate mail from a service you forgot about, such as the automatic invoices sent by your online shop.
Checking the result
After a few hours, send a message to a test address from mail-tester.com or to a Gmail address of your own. In Gmail, open the message, choose "Show original" and look at the SPF, DKIM and DMARC lines: all three should say PASS.
Common mistakes
- two SPF records on the same domain;
- editing the zone in cPanel while the domain points to other nameservers;
- a
ruaaddress that does not exist; - setting
p=rejecton day one.
