cPanel/WHM Email Authentication Setup

Web hosting control panel with built-in email server management. This guide covers the complete email authentication stack for cPanel/WHM: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.

How to Set Up SPF for cPanel/WHM

Configure SPF records for email sent from your cPanel-hosted server using the Email Deliverability tool.

Quick Answer — The Record You Need

Type

TXT

Host / Name

@

Value
v=spf1 +a +mx +ip4:YOUR.SERVER.IP ~all

Replace YOUR.SERVER.IP with your actual server IP address. cPanel can auto-generate this via the Email Deliverability tool.

Step-by-Step Setup

1

Log in to cPanel

Access your cPanel account (typically at yourdomain.com:2083 or yourdomain.com/cpanel).

2

Open Email Deliverability

Navigate to Email > Email Deliverability. This tool checks and manages SPF, DKIM, and reverse DNS.

3

Review the suggested SPF record

cPanel analyzes your domain and suggests an SPF record based on your server configuration. Click "Manage" or "Repair" next to your domain.

4

Accept or customize the SPF record

cPanel generates an SPF record including your server IP. You can accept the suggestion or customize it.

v=spf1 +a +mx +ip4:203.0.113.10 ~all
5

Install the record

Click "Install" or "Repair" to apply the SPF record. cPanel adds it to the DNS zone automatically if you use cPanel DNS.

Before & After

Before
(no SPF record)
After
v=spf1 +a +mx +ip4:203.0.113.10 ~all

SPF Gotchas

  • cPanel uses IP-based SPF (ip4: mechanism) rather than include: mechanisms because it sends directly from your server.
  • If you use external mail services (Google Workspace, Microsoft 365) alongside cPanel, add their includes to the SPF record too.
  • Server-level SPF configuration in WHM (root access) can set defaults for all accounts. Account-level settings in cPanel are per-domain.

SPF FAQ

How do I find my cPanel server IP for SPF?

The Email Deliverability tool in cPanel auto-detects your server IP and includes it in the suggested SPF record. You can also check in WHM > Server Information.

Should I use +a +mx or ip4: in my cPanel SPF?

ip4: with your server IP is most precise. +a +mx are convenient but resolve at lookup time and can be less predictable.

Can I manage SPF from WHM instead of cPanel?

Yes. WHM (root access) can manage DNS zones for all accounts and set server-wide email authentication defaults.

How to Set Up DKIM for cPanel/WHM

Enable DKIM signing on your cPanel-hosted server using the built-in Email Deliverability tool or WHM.

Quick Answer — The Record You Need

Type

TXT

Host / Name

default._domainkey

Value
v=DKIM1; k=rsa; p=AUTO_GENERATED_BY_CPANEL

cPanel auto-generates DKIM keys. The default selector is "default". Use the Email Deliverability tool to manage it.

Step-by-Step Setup

1

Log in to cPanel

Access your cPanel account.

2

Open Email Deliverability

Navigate to Email > Email Deliverability.

3

Check DKIM status

The tool shows whether DKIM is configured for your domain. If not, it offers to generate and install the key.

4

Generate and install DKIM

Click "Manage" or "Repair" to auto-generate a DKIM key pair. cPanel creates the private key on the server and publishes the public key in DNS.

default._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANB..."
5

Verify

Send a test email and check the headers for a DKIM-Signature with s=default and a pass result.

DKIM Gotchas

  • cPanel uses "default" as the DKIM selector. This is standard for cPanel/Exim setups.
  • DKIM requires the Exim mail server to be configured for signing. In WHM, check Service Configuration > Exim Configuration Manager > DKIM.
  • If cPanel manages your DNS, the DKIM record is added automatically. If DNS is managed externally, you need to copy the TXT record to your DNS provider.

DKIM FAQ

What DKIM selector does cPanel use?

cPanel uses "default" as the DKIM selector. The record is published at default._domainkey.yourdomain.com.

Does cPanel auto-generate DKIM keys?

Yes. The Email Deliverability tool in cPanel can auto-generate DKIM key pairs and install the DNS record.

Can I manage DKIM from WHM?

Yes. In WHM, go to Service Configuration > Exim Configuration Manager to enable DKIM signing server-wide.

How to Set Up DMARC for cPanel/WHM

Publish a DMARC record for your cPanel-hosted domain to protect against email spoofing.

Quick Answer — The Record You Need

Type

TXT

Host / Name

_dmarc

Value
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Set up SPF and DKIM via the Email Deliverability tool first.

Step-by-Step Setup

1

Configure SPF and DKIM

Use cPanel Email Deliverability to set up both SPF and DKIM first.

2

Open DNS Zone Editor

In cPanel, go to Domains > Zone Editor (or Advanced Zone Editor).

3

Add the DMARC record

Add a TXT record with name _dmarc.yourdomain.com and the DMARC policy value.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
4

Monitor reports

Review DMARC reports to confirm your server's emails pass authentication.

5

Enforce gradually

Move from p=none to p=quarantine to p=reject.

DMARC Gotchas

  • cPanel Email Deliverability handles SPF and DKIM but does not auto-create DMARC records. You need to add DMARC manually via the Zone Editor.
  • If your cPanel account sends email from multiple domains, each domain needs its own DMARC record.
  • Shared hosting servers may have other users sending from the same IP. DKIM alignment (not SPF) is more reliable for DMARC on shared hosting.

DMARC FAQ

Does cPanel create DMARC records automatically?

No. The Email Deliverability tool manages SPF and DKIM, but DMARC must be added manually via the Zone Editor.

Can I use p=reject on shared hosting with cPanel?

Yes, but test carefully. Shared hosting means other users may send from the same server. DKIM alignment is more reliable than SPF in this case.

Where do I add DMARC in cPanel?

Use Domains > Zone Editor. Add a TXT record with the name _dmarc.yourdomain.com and your DMARC policy value.

Verify Your cPanel/WHM Setup

Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.

Setup Guides for Other Providers