If emails from your domain land in spam or get rejected, the cause is often missing email authentication. Three DNS records fix most of it: SPF, DKIM and DMARC.
SPF: who may send email for your domain
SPF is a TXT record listing the servers allowed to send mail for your domain. Example: v=spf1 +a +mx include:mailprovider.example ~all. A receiving server checks it to see whether the sending server is on the list. Keep only one SPF record per domain.
DKIM: a digital signature on every message
With DKIM your mail server signs each message with a private key, and receivers verify the signature with a public key published in DNS (a TXT record). It proves that the message was not altered and really comes from your domain. In cPanel, open Email Deliverability to see whether DKIM is active.
DMARC: what to do when checks fail
DMARC is a TXT record on _dmarc.yourdomain.com. It tells receivers whether to accept, quarantine or reject mail that fails SPF and DKIM, and where to send reports. Start with p=none to monitor, then move to quarantine and reject when you are confident.
| Record | Where | Purpose |
|---|---|---|
| SPF | TXT on the domain | Authorised sending servers |
| DKIM | TXT on selector._domainkey | Message signature |
| DMARC | TXT on _dmarc | Policy and reports |
How to check them
- Open the DNS lookup and choose TXT for your domain: look for
v=spf1. - Look up
_dmarc.yourdomain.comas the domain with TXT type. - Send a test email to a mailbox and check the message headers for SPF, DKIM and DMARC "pass".
Common mistakes
- Two SPF records instead of one.
- Forgetting to include a third-party sender (newsletter tool, CRM).
- Too many DNS lookups in SPF (limit of 10).
- Setting DMARC to reject before everything passes.
Set up your mailbox first: create business email on your domain.
A step-by-step setup order
- Create your mailbox and send a test message.
- Publish an SPF record that lists every service that sends mail for you.
- Enable DKIM at your mail provider and publish the public key it gives you.
- Publish a DMARC record with
p=noneand an address for reports. - Review the reports for a few weeks and fix any legitimate sender that fails.
- Tighten DMARC to quarantine, then reject.
A basic DMARC record
Name: _dmarc.yourdomain.com Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Why messages still reach spam
Authentication is necessary but not sufficient. Spam filters also consider content, sending reputation, complaint rates and whether your IP address is shared with senders who misbehave. Send relevant email to people who expect it, keep lists clean, and avoid sending bulk newsletters through a regular mailbox.
FAQ
Do I need all three?
Yes, for reliable delivery. Large mailbox providers increasingly require authentication, especially for bulk senders.
Where do I add these records?
At whoever hosts your DNS. If you use our nameservers, in cPanel's Zone Editor. See the KB guide.
Try it now: use our free WHOIS lookup, DNS lookup, nameserver checker, SSL checker and IP & hosting lookup. All free, no signup.