SPF, DKIM & DMARC via cPanel Email Deliverability

cPanel includes a built-in Email Deliverability tool that generates and installs SPF, DKIM, and DMARC records for your hosted domains automatically. This guide walks through each record, what it does, and how to set it up correctly.

Why these records matter

Without SPF, DKIM, and DMARC, email from your domain is far more likely to land in spam — or be rejected outright by modern mail providers like Gmail, Outlook, and Yahoo. These three records work together:

Record	What it does
SPF	Lists which mail servers are authorized to send email for your domain
DKIM	Adds a cryptographic signature to outgoing mail so receivers can verify it wasn't tampered with
DMARC	Tells receiving servers what to do when SPF or DKIM fails, and where to send failure reports

All three are required for reliable inbox delivery in 2024 and beyond. Gmail and Yahoo now enforce DMARC as a condition of acceptance for bulk senders.

Accessing Email Deliverability

1. Log into cPanel at https://YOUR_SERVER_IP:2083.
2. Scroll to the Email section and click Email Deliverability.
3. cPanel scans all domains on the account and shows their current deliverability status — green checkmarks for records that are correctly configured, warnings for missing or misconfigured records.

Understanding the status indicators

Each domain shows one of three states:

• Valid (green) — the record exists and matches what cPanel expects
• Invalid (orange) — the record exists but has a problem
• Missing (red) — the record doesn't exist at all

Click Manage next to any domain to see the full detail and fix issues.

Setting up SPF

SPF (Sender Policy Framework) is a TXT record on your domain that lists which IP addresses and mail servers are allowed to send email on its behalf.

What cPanel generates

cPanel creates an SPF record that includes:

• Your server's IP address
• The MailChannels relay (which handles all outbound mail on RemarkableCloud servers)
• Common mechanisms for mail sent through cPanel itself

A typical generated SPF record looks like:

v=spf1 +a +mx +ip4:YOUR_SERVER_IP include:mailchannels.net ~all

Installing SPF via Email Deliverability

1. In Email Deliverability, click Manage next to your domain.
2. Find the SPF section. If it shows as Invalid or Missing, you'll see a suggested record below the current value.
3. Click Install the suggested record. cPanel writes the record to your DNS zone automatically.
4. The status updates to Valid within a few seconds.

ℹ

DNS managed externally?

If your domain's DNS is managed at Cloudflare, your registrar, or another provider — not on this server — cPanel cannot install the record automatically. Copy the suggested record value and add it manually as a TXT record at your DNS provider.

SPF for MailChannels (RemarkableCloud specific)

RemarkableCloud routes all outbound mail through MailChannels. If cPanel's suggested SPF record does not already include include:mailchannels.net, add it manually. The final record should look like:

v=spf1 +a +mx +ip4:YOUR_SERVER_IP include:mailchannels.net ~all

The ~all at the end means emails from unauthorized sources are soft-failed (delivered to spam rather than rejected). Once you're confident your SPF is complete, you can change it to -all for a hard fail.

Only one SPF record per domain

A domain can only have one SPF record. If you already have an SPF record and need to add MailChannels, edit the existing record — do not add a second one. Multiple SPF records cause SPF to fail entirely.

If you use external services like Google Workspace or Mailchimp for some email, add their includes to the same record:

v=spf1 +a +mx +ip4:YOUR_SERVER_IP include:mailchannels.net include:_spf.google.com ~all

Setting up DKIM

DKIM (DomainKeys Identified Mail) works by generating a public/private key pair. Your server signs every outgoing email with the private key. Receiving servers look up the public key in your DNS and verify the signature. If it matches, the email is proven to be genuine and unaltered.

Generating and installing DKIM

1. In Email Deliverability, click Manage next to your domain.
2. Find the DKIM section.
3. If DKIM is not yet set up, click Enable or Install the suggested record. cPanel generates a 2048-bit RSA key pair, stores the private key on the server, and installs the public key as a TXT record in your DNS zone.
4. The DKIM record appears under the name default._domainkey.yourdomain.com and looks like: ``` v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBA...very long key... ```
5. Status updates to Valid once installed.

✓

2048-bit keys

cPanel generates 2048-bit DKIM keys by default. This is the current recommended minimum. Some older setups use 1024-bit keys — if you see a 1024-bit key in use, regenerate it. Go to Email Deliverability → Manage → DKIM → Regenerate.

If DNS is managed externally

cPanel shows the full DKIM TXT record value in the Manage screen. Copy the entire value (it's long) and create a TXT record at your DNS provider:

• Name: default._domainkey (or default._domainkey.yourdomain.com depending on your provider)
• Type: TXT
• Value: the full string starting with v=DKIM1; k=rsa; p=...

Setting up DMARC

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It tells receiving mail servers what to do when a message fails both checks — and optionally sends you reports about what's happening.

cPanel's DMARC record

cPanel's Email Deliverability tool can suggest a basic DMARC record. However, DMARC policy is a deliberate decision — you should understand what you're setting before installing it.

A DMARC record is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

DMARC policy values

Policy	What happens to failing mail	When to use
p=none	Delivered normally — DMARC only monitors	Start here
p=quarantine	Goes to the spam folder	After monitoring for 2–4 weeks
p=reject	Rejected outright, never delivered	Once you're confident everything is correct

Recommended rollout sequence

1. Start with p=none and add a reporting address. This lets you monitor without affecting delivery.
2. Wait 2–4 weeks and review the DMARC reports (delivered to the rua address). Look for legitimate mail sources that are failing SPF or DKIM — fix those first.
3. Move to p=quarantine once you're confident all legitimate senders pass. Failing mail goes to spam instead of inbox.
4. Move to p=reject once no legitimate mail is failing. This is the strongest protection and prevents any spoofed mail from reaching recipients.

⚠

Do not start with p=reject

If you jump straight to p=reject and your SPF or DKIM isn't perfectly configured, legitimate mail from your domain gets rejected. Always start with p=none and monitor first.

Installing DMARC via Email Deliverability

1. In Email Deliverability → Manage → find the DMARC section.
2. Click Install the suggested record to add cPanel's default DMARC record, or click Customize to set your own policy and reporting address.
3. Set the rua tag to an email address you actually check — DMARC aggregate reports are sent there. Create a dedicated address like dmarc@yourdomain.com for this.
4. Save. The record is added to your DNS zone as a TXT record at _dmarc.yourdomain.com.

Reading DMARC reports

DMARC aggregate reports (sent to your rua address) are XML files showing:

• Which IPs sent mail claiming to be from your domain
• Whether SPF and DKIM passed or failed for each source
• How many messages were sent from each source

The raw XML is hard to read. Use a free tool like dmarcian.com or MXToolbox DMARC Analyzer to parse and visualize the reports.

Verifying everything is working

In cPanel Email Deliverability

Go back to Email → Email Deliverability — all three records should show green Valid status.

Via command line

# Check SPF
dig yourdomain.com TXT +short | grep spf

# Check DKIM
dig default._domainkey.yourdomain.com TXT +short

# Check DMARC
dig _dmarc.yourdomain.com TXT +short

Send a test email

Send an email from your domain to mail-tester.com — it scores your setup out of 10 and flags any remaining issues. A fully configured domain with SPF, DKIM, and DMARC should score 9–10/10.

You can also use Gmail — send an email to a Gmail address, open it, click the three-dot menu → Show original → check the Authentication-Results header. You should see:

spf=pass
dkim=pass
dmarc=pass

Common issues

SPF record already exists with different content Edit the existing record rather than adding a new one. Two SPF records cause both to be ignored. Merge all your include: statements into a single TXT record.

DKIM shows Valid in cPanel but fails externally DNS propagation delay. Wait up to 24 hours after installing. Verify the record is live with dig default._domainkey.yourdomain.com TXT.

DMARC reports show Google Workspace or Mailchimp failing Those services need to be authorized in your SPF record and have DKIM set up through their own settings. Add include:_spf.google.com to SPF for Google, and follow your email provider's DKIM setup guide for each additional service.

Email Deliverability shows domain as Unresolvable The domain's DNS zone doesn't exist on this server. Either the domain's nameservers don't point here, or the DNS zone wasn't created. Add the zone in WHM → DNS Functions → Add DNS Zone, or manage records at your external DNS provider.

⚡

Managed VPS · Cloud Cubes

Fully managed hosting starting at $2/mo

NVMe SSD, daily backups, 500% SLA, free migration. First month 75% off.

$2 / first month

View Plans →

Next steps

• Create an email account in cPanel
• Setting email DNS records
• Email sending limits