In short
SPF says which servers may send mail for your domain, DKIM signs each message to prove it wasn't altered, and DMARC tells the receiver what to do when neither matches the visible sender. In cPanel, SPF and DKIM are created from Email › Email Deliverability; DMARC is added as a TXT record at _dmarc.yourdomain. Start with p=none to receive reports, then move to p=quarantine and p=reject once all your legitimate mail passes.
What each record does
| Record | What it checks | Where it lives |
|---|---|---|
| SPF | That the sending IP is authorized by the envelope (Return-Path) domain | TXT on yourdomain.com |
| DKIM | That the message is unchanged and was signed by the domain | TXT on selector._domainkey.yourdomain.com (in cPanel, default._domainkey) |
| DMARC | That SPF or DKIM pass with the same domain the user sees in the From, and what to do if not | TXT on _dmarc.yourdomain.com |
SPF and DKIM on their own don't stop someone putting your domain in the From. Only DMARC ties them to the visible sender, which is why it's the record that does the most against spoofing.
The Email Deliverability tool
- Go to cPanel › Email › Email Deliverability. WHM has the same tool to review every domain on the server.
- Each domain shows "Valid" or "Problems exist". Open Manage on the ones with problems.
- If DNS is hosted on the same server, the Repair button creates or fixes SPF and DKIM automatically.
- If DNS is with another provider (Cloudflare, your registrar or anyone else), copy the suggested records and create them there by hand.
SPF: authorize the servers that send
An SPF record lists the IPs and services allowed to send for your domain. Example for a domain that sends from its cPanel server and from a campaign service:
yourdomain.com. TXT "v=spf1 +a +mx ip4:203.0.113.10 include:spf.campaign-service.com ~all"- One SPF record per domain. Two
v=spf1records invalidate both. - At most 10 DNS lookups. Every
include,a,mxandredirectcounts, including nested ones. Go over and SPF returns an error (permerror) and is treated as if it didn't exist. - `~all` or `-all`.
~all(softfail) marks unauthorized mail as suspicious;-all(fail) rejects it. With DMARC in place,~allis enough and avoids trouble with forwarding. - Don't include services you no longer use. Each include lets every customer of that service send as you.
DKIM: sign every message
cPanel generates one DKIM key per domain with the selector default. The private key stays on the server and Exim signs every outgoing message; the public key is published in DNS:
default._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"- Use 2048-bit keys. On external DNS the value is long; some panels split it into several quoted strings, which is fine.
- Copy the whole value with nothing extra. A space or invisible character in the middle of the key makes DKIM fail on some receivers.
- If you rotate the key on the server, publish it again in DNS. It's the most common mistake when DNS lives outside cPanel.
- Every external service signs with its own selector. Your campaign service will give you its own DKIM record; it doesn't replace cPanel's.
DMARC: policy and reports
Create a TXT record at _dmarc.yourdomain.com (in cPanel: Domains › Zone Editor). To begin with, monitoring only:
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r"| Tag | What it's for | Values |
|---|---|---|
| p | What to do with mail that fails | none (report only), quarantine (to spam), reject |
| rua | Where to send the daily aggregate reports | mailto:address |
| sp | Policy for subdomains | Same as p; inherits p if omitted |
| pct | Share of mail the policy applies to | 1 to 100, useful for ramping up |
| adkim / aspf | Strict (s) or relaxed (r) alignment | r allows subdomains of the same domain |
How to reach p=reject without losing mail
- Weeks 1 to 4: `p=none`. Read the rua reports (a DMARC analysis service makes them readable) and list every service that sends as your domain: server, invoicing, CRM, campaigns, website forms.
- Fix each source by adding it to SPF or setting up its DKIM with your domain.
- `p=quarantine; pct=25`, then raise the percentage to 100 over a few weeks if no legitimate failures show up.
- `p=reject`. From here on nobody can send mail as exactly your domain without authorization.
Pay special attention to invoicing and accounting platforms: many send documents on behalf of your domain, and they are the first thing to break under p=reject.
How to verify
# SPF
dig +short TXT yourdomain.com | grep spf1
# DKIM (cPanel's default selector)
dig +short TXT default._domainkey.yourdomain.com
# DMARC
dig +short TXT _dmarc.yourdomain.comThen send an email to Gmail and check under Show original that SPF, DKIM and DMARC say PASS. How to read the result: how to read email headers.
Common mistakes
| Mistake | Symptom | Fix |
|---|---|---|
| Two SPF records | spf=permerror | Merge them into one |
| More than 10 SPF lookups | spf=permerror at some receivers | Drop unused includes or replace them with ip4 |
| DKIM rotated but not published | dkim=fail on every message | Copy the current key from Email Deliverability |
| DMARC on the wrong name | dmarc=none even though the record exists | It must be at _dmarc.yourdomain, not yourdomain |
| p=reject without reading reports | Invoices or form emails rejected | Go back to p=none and add the missing sources |
Frequently asked questions
Which is better in SPF, ~all or -all?
With DMARC in place, ~all is enough and avoids issues with forwarding. -all is stricter, but DMARC decides the final policy.
Where is the DKIM key in cPanel?
In Email › Email Deliverability › Manage, for each domain. The selector is default, so the record goes at default._domainkey.yourdomain.
How long does DMARC take to work?
The record works as soon as it propagates in DNS, usually within minutes. The first reports arrive the next day.
Can I use p=reject from day one?
It's not recommended. Without reading the reports, you can block legitimate mail from services sending on your behalf, such as invoicing or your CRM.
Protect inbound email on your whole server
Clisec validates SPF, DKIM and DMARC on every inbound email and blocks impersonation across your cPanel server, with no MX changes.