Web hosting control panel with built-in email server management. This guide covers the complete email authentication stack for cPanel/WHM: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.
Configure SPF records for email sent from your cPanel-hosted server using the Email Deliverability tool.
TXT
@
v=spf1 +a +mx +ip4:YOUR.SERVER.IP ~all
Replace YOUR.SERVER.IP with your actual server IP address. cPanel can auto-generate this via the Email Deliverability tool.
Access your cPanel account (typically at yourdomain.com:2083 or yourdomain.com/cpanel).
Navigate to Email > Email Deliverability. This tool checks and manages SPF, DKIM, and reverse DNS.
cPanel analyzes your domain and suggests an SPF record based on your server configuration. Click "Manage" or "Repair" next to your domain.
cPanel generates an SPF record including your server IP. You can accept the suggestion or customize it.
v=spf1 +a +mx +ip4:203.0.113.10 ~allClick "Install" or "Repair" to apply the SPF record. cPanel adds it to the DNS zone automatically if you use cPanel DNS.
(no SPF record)v=spf1 +a +mx +ip4:203.0.113.10 ~allThe Email Deliverability tool in cPanel auto-detects your server IP and includes it in the suggested SPF record. You can also check in WHM > Server Information.
ip4: with your server IP is most precise. +a +mx are convenient but resolve at lookup time and can be less predictable.
Yes. WHM (root access) can manage DNS zones for all accounts and set server-wide email authentication defaults.
Enable DKIM signing on your cPanel-hosted server using the built-in Email Deliverability tool or WHM.
TXT
default._domainkey
v=DKIM1; k=rsa; p=AUTO_GENERATED_BY_CPANEL
cPanel auto-generates DKIM keys. The default selector is "default". Use the Email Deliverability tool to manage it.
Access your cPanel account.
Navigate to Email > Email Deliverability.
The tool shows whether DKIM is configured for your domain. If not, it offers to generate and install the key.
Click "Manage" or "Repair" to auto-generate a DKIM key pair. cPanel creates the private key on the server and publishes the public key in DNS.
default._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjANB..."Send a test email and check the headers for a DKIM-Signature with s=default and a pass result.
cPanel uses "default" as the DKIM selector. The record is published at default._domainkey.yourdomain.com.
Yes. The Email Deliverability tool in cPanel can auto-generate DKIM key pairs and install the DNS record.
Yes. In WHM, go to Service Configuration > Exim Configuration Manager to enable DKIM signing server-wide.
Publish a DMARC record for your cPanel-hosted domain to protect against email spoofing.
TXT
_dmarc
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
Set up SPF and DKIM via the Email Deliverability tool first.
Use cPanel Email Deliverability to set up both SPF and DKIM first.
In cPanel, go to Domains > Zone Editor (or Advanced Zone Editor).
Add a TXT record with name _dmarc.yourdomain.com and the DMARC policy value.
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1Review DMARC reports to confirm your server's emails pass authentication.
Move from p=none to p=quarantine to p=reject.
No. The Email Deliverability tool manages SPF and DKIM, but DMARC must be added manually via the Zone Editor.
Yes, but test carefully. Shared hosting means other users may send from the same server. DKIM alignment is more reliable than SPF in this case.
Use Domains > Zone Editor. Add a TXT record with the name _dmarc.yourdomain.com and your DMARC policy value.
Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.