Your website can be fast, secure, and professionally designed, but email problems can still make your business look unreliable. If invoices, contact-form replies, password resets, or newsletters land in spam, customers may never see them. Learning how to set up SPF and DKIM records for email deliverability helps receiving mail servers verify that your messages are legitimate.
SPF and DKIM are DNS records. You add them where your domain’s DNS is managed, often in cPanel’s Zone Editor. They work in different ways, but together they give Gmail, Outlook, Yahoo, and other providers stronger evidence that mail sent from your domain is authorized.
Why SPF and DKIM matter for deliverability
Spam filters do not make decisions based on one setting alone. They evaluate sender reputation, message content, sending behavior, links, user engagement, and technical authentication. SPF and DKIM are foundational because they help prevent someone else from impersonating your domain.
SPF, or Sender Policy Framework, identifies the servers and services allowed to send email for your domain. When a receiving server gets a message from you, it checks whether the sending server appears on that approved list.
DKIM, or DomainKeys Identified Mail, adds a digital signature to outgoing messages. The receiving server uses a public key published in your DNS to verify that the message was signed by an authorized system and was not changed in transit.
Neither record guarantees inbox placement. A properly authenticated email can still go to spam if it has a poor reputation or looks suspicious. But without authentication, even legitimate business email faces a much harder path to the inbox.
Before you add records, list every email sender
The most common SPF mistake is forgetting an email service. Your domain may send mail from more places than you expect: your cPanel mailbox, a website contact form, an ecommerce platform, a marketing platform, a help desk, an accounting tool, or Google Workspace or Microsoft 365.
Make a quick list of every service that sends mail using your domain in the From address. Then find each provider’s current SPF and DKIM setup instructions inside its account settings or support documentation. Those providers supply the exact DNS values you need.
This step matters because an SPF record must include all approved senders. If you add a record for your website hosting mail server but leave out your newsletter platform, newsletter messages may fail SPF checks. On the other hand, authorizing services you do not use expands the number of systems allowed to send as your domain.
Also confirm where DNS is hosted. Your domain may be registered with one company while its nameservers point to your hosting account, a website builder, or a separate DNS provider. Add records only in the active DNS zone. Changing records in the wrong dashboard will not affect live email.
How to set up SPF and DKIM records in cPanel
If your domain uses cPanel DNS, sign in to cPanel and look for Zone Editor. Some cPanel accounts also include an Email Deliverability tool that identifies missing or invalid SPF and DKIM records and may offer a repair option for mail handled by the hosting account.
The exact screen labels can vary by hosting plan and cPanel version, but the process is the same: locate the domain, review its existing TXT and CNAME records, and add or update the values provided by your email services.
Create or update your SPF TXT record
SPF is published as a TXT record. A basic example for a domain that sends mail through its hosting server might look like this:
v=spf1 a mx ip4:192.0.2.25 -all
This is only an example, not a value to copy blindly. The a and mx mechanisms authorize the servers connected to your domain’s A and MX records. The ip4 mechanism authorizes a specific sending IP address. The -all ending tells recipients that servers not listed should fail SPF.
Your actual record may instead contain an include value supplied by a third-party provider, such as a business email or email marketing service. For example, a provider might instruct you to add something similar to include:provider-example.com. Use the provider’s published value exactly as given.
The key rule is simple: publish only one SPF TXT record for each domain. Do not create separate SPF records for your hosting mail, Google Workspace, and marketing platform. Multiple SPF records can cause an SPF PermError, which means the receiving server cannot reliably evaluate authorization.
Instead, combine the required mechanisms and includes into one record. If you already have an SPF record, edit it carefully rather than adding another one. Avoid making assumptions about what to combine. A missing space, an outdated include, or too many DNS lookups can make an otherwise valid record fail.
For domains that no longer send email at all, a restrictive SPF record such as v=spf1 -all may be appropriate. Do not use that setting if any service still sends messages from the domain.
Add the DKIM record from your email provider
DKIM setup starts with the email service that sends your mail. In the service’s admin area, enable DKIM or email authentication. It will generate one or more DNS records, usually with a name that includes a selector and ._domainkey.
A DKIM TXT record may resemble this format:
selector1._domainkey.example.com
The value begins with something like v=DKIM1; k=rsa; p= followed by a long public key. Copy the full value exactly. Do not add extra quotation marks unless your DNS editor does so automatically, and do not shorten the key.
Some providers use CNAME records instead of a long TXT key. In that case, add the CNAME host name and target exactly as the provider specifies. This arrangement lets the provider manage key rotation on its side, which can reduce maintenance for you.
If you use cPanel-hosted email, check the Email Deliverability section first. It may generate the correct DKIM record for the server. If another provider handles all outgoing mail, use that provider’s DKIM record instead. In some setups, both hosting email and a third-party mail service need DKIM configured because both send mail from the same domain.
Verify the records and allow time for DNS updates
Save each DNS change, then give DNS time to update. Changes can appear quickly, but it may take several hours and occasionally up to 24 to 48 hours for all systems to recognize them. The TTL value on your existing records and DNS provider behavior both affect timing.
After the records have propagated, send a test email to an address you can inspect. Many email clients show authentication results in the message headers. Look for SPF and DKIM results marked as pass. Your email provider may also have its own domain authentication status page.
If SPF fails, check that the sending service is included in your one SPF record and that the domain in the envelope sender matches the domain you authenticated. If DKIM fails, confirm the selector in the message header matches the selector in your DNS record. A selector mismatch is common when an old DKIM key remains in place after changing email providers.
Add DMARC after SPF and DKIM are working
DMARC builds on SPF and DKIM. It tells receiving servers how to handle mail that fails authentication and provides reporting that can reveal unauthorized senders. Major mailbox providers increasingly expect DMARC for domains that send bulk email.
Start with a monitoring policy while you confirm that every legitimate sending service passes alignment. A basic starting record can use p=none, then you can move toward quarantine or reject when reports show your setup is complete. Moving too quickly can block legitimate mail from a forgotten service, so this is a place to be cautious.
Email authentication is not a one-time task. Review your SPF and DKIM records whenever you add a new mailing platform, move business email providers, change website hosting, or retire an old tool. A few minutes of DNS maintenance can protect your domain’s reputation and give every legitimate message a better chance to reach the people waiting for it.