How to Set Up SPF, DKIM and DMARC Records for Your Domain

How to Set Up SPF, DKIM and DMARC Records for Your Domain

SPF, DKIM and DMARC are DNS records that prove your emails are genuinely sent from your domain. Without them, your emails are far more likely to land in spam folders — or be rejected outright. This guide shows you how to add all three records in cPanel.

What Are SPF, DKIM and DMARC?

• SPF (Sender Policy Framework) — tells receiving mail servers which IP addresses are allowed to send email on behalf of your domain.
• DKIM (DomainKeys Identified Mail) — adds a digital signature to outgoing emails so recipients can verify they haven't been tampered with in transit.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) — tells receiving servers what to do if an email fails SPF or DKIM checks (nothing, quarantine, or reject).

You need all three for reliable email delivery. SPF and DKIM alone are not enough — DMARC ties them together and signals to mail providers that you take email security seriously.

Step 1 — Check What Records You Already Have

Before adding records, check whether any already exist to avoid conflicts.

1. Log in to your Host Dada control panel.
2. Open cPanel for the relevant hosting account.
3. Go to Domains → Zone Editor.
4. Click Manage next to your domain.
5. Look for existing TXT records that contain:
   • v=spf1 — an existing SPF record
   • v=DKIM1 — an existing DKIM record
   • v=DMARC1 — an existing DMARC record

If any of these already exist, update them rather than creating a second copy — having two SPF records will break email delivery.

Step 2 — Add or Update Your SPF Record

The SPF record is a TXT record on your root domain.

1. In Zone Editor, click + Add Record and select TXT.
2. Set the Name to your domain (e.g. yourdomain.co.uk) — some panels use @ to mean the root domain.
3. Set the TTL to 3600 (one hour).
4. In the Record (value) field, enter:

v=spf1 include:spf.hostdada.co.uk ~all

If you send email from other services (e.g. Mailchimp, Google Workspace, SendGrid), you must add their include: entries as well — for example:

v=spf1 include:spf.hostdada.co.uk include:servers.mcsv.net ~all

Click Save Record.

What ~all means: Emails from unlisted servers will be marked as suspicious (soft fail). If you use -all (hard fail), emails from unlisted servers will be rejected — only do this once you are confident your SPF record is complete.

Step 3 — Enable DKIM Signing in cPanel

cPanel can generate and manage your DKIM key automatically.

1. In cPanel, go to Email → Email Deliverability.
2. Your domains are listed here. If DKIM shows a warning icon, click Repair next to the domain.
3. cPanel will generate a DKIM key pair and add the required DNS record automatically (if your domain's DNS is managed here).
4. If your DNS is managed externally (e.g. Cloudflare, 123-Reg), click View next to the DKIM entry to copy the full TXT record value, then add it manually at your DNS provider.

The DKIM record is added as a TXT record on the subdomain default._domainkey.yourdomain.co.uk.

Tip: Allow up to 30 minutes for the DKIM record to propagate before testing.

Step 4 — Add a DMARC Record

DMARC is also a TXT record, placed on the subdomain _dmarc.yourdomain.co.uk.

1. In Zone Editor, click + Add Record → TXT.
2. Set the Name to _dmarc.yourdomain.co.uk (or _dmarc if your panel auto-appends the domain).
3. Set TTL to 3600.
4. Enter the following as the record value:

v=DMARC1; p=none; rua=mailto:admin@yourdomain.co.uk; ruf=mailto:admin@yourdomain.co.uk; fo=1;

Replace admin@yourdomain.co.uk with an email address where you want to receive DMARC reports.

Understanding the policy (p=):

• p=none — monitor only; no action taken on failing emails (start here)
• p=quarantine — failing emails go to spam
• p=reject — failing emails are blocked entirely (use only when confident)

Click Save Record.

Step 5 — Test Your Records

After saving, verify everything is working correctly.

Using cPanel's Email Deliverability tool

1. Go to Email → Email Deliverability in cPanel.
2. All three records (SPF, DKIM, DMARC) should show a green tick.
3. If any show a warning, click Repair to let cPanel fix them automatically.

Using a free online checker

You can also use MXToolbox (mxtoolbox.com) to test each record independently:

• Use the SPF Record Lookup tool
• Use the DKIM Lookup tool (enter your selector — usually default — and domain)
• Use the DMARC Lookup tool

Common Issues and Fixes

Emails still going to spam after setting up records

DNS changes can take up to 48 hours to fully propagate. Wait 24 hours and test again. Also ensure your DKIM record value was copied exactly — even a single character error will invalidate the signature.

"Multiple SPF records found" warning

You must only have one SPF TXT record on your root domain. If you previously had one and added another, delete the old one and merge all include: entries into a single record.

DMARC reports not arriving

Some receiving mail servers only send aggregate DMARC reports once per day. Also verify the rua=mailto: address is a valid, working mailbox on your domain.

DKIM shows as invalid even after adding the record

Check that the record was added to the correct subdomain (default._domainkey) and that no extra spaces or line breaks were introduced when copying the key value. DKIM public keys are long strings and must be added exactly as shown.

Related Articles

• Microsoft 365 DNS Setup — MX, SPF, DKIM, DMARC & Autodiscover
• How to Add an MX Record in cPanel
• How to Enable SpamAssassin in cPanel