How to Add cPanel SPF and DKIM Records When Your DNS Is at Cloudflare or Your Registrar

Updated: 29 September 2026 · Applies to: cPanel & WHM 138 (Email Deliverability) with DNS at Cloudflare, a domain registrar or another DNS provider

If your domain's nameservers are not ours (for example, you use Cloudflare or your registrar's DNS), cPanel can't publish the SPF and DKIM records for you. Email Deliverability then shows the records as missing, and the Repair button is not available. The fix is to copy the records from cPanel and add them at your DNS provider. It takes about ten minutes.

1. Check where your DNS is hosted

dig +short NS example.com          # Linux and macOS
nslookup -type=NS example.com      # Windows

If the answer shows names such as *.ns.cloudflare.com or your registrar's nameservers, add the records there. If your domain uses our nameservers, use Repair instead (see cPanel Email Deliverability: SPF and DKIM).

2. Copy the records from cPanel

1. In cPanel, open Email › Email Deliverability and click Manage next to the domain.
2. In the DKIM section, find the Suggested "DKIM" (TXT) Record. Its Name is default._domainkey.example.com. Choose Full and copy the Value (it starts with v=DKIM1; k=rsa; p=). Choose Split instead only if your DNS provider asks you to enter long values in parts of up to 255 characters.
3. In the SPF section, copy the suggested record (it starts with v=spf1 and includes your hosting server's IP address).

3. Add them at Cloudflare

1. In the Cloudflare dashboard, open your domain and go to DNS › Records.
2. Click Add record: Type TXT, Name default._domainkey, Content the DKIM value. Save.
3. SPF: if a TXT record starting with v=spf1 already exists, edit it and merge the cPanel parts into it (see step 5). Otherwise add a TXT record with Name @ and the SPF value.
4. Check that the mail record and any other host names used for email are set to DNS only (grey cloud). Cloudflare's proxy only handles web traffic, not mail.

Cloudflare adds your domain name to the Name automatically, so default._domainkey becomes default._domainkey.example.com. It also splits long values itself, which is why you copy the Full value.

4. Add them at another DNS provider

The steps are the same: create a TXT record for DKIM and one TXT record for SPF. The only thing that differs is the name field:

• Most providers want only default._domainkey and add the domain themselves.
• A few want the full name, default._domainkey.example.com, sometimes with a dot at the end.

If you're not sure, enter the short form and check it with the command in step 6. A record named default._domainkey.example.com.example.com means the provider added the domain twice.

5. Merge SPF into a single record

A domain may have only one SPF record. If you also send mail through other services, put everything in one record, for example for cPanel hosting plus Google Workspace:

v=spf1 +a +mx +ip4:203.0.113.10 include:_spf.google.com ~all

Two TXT records that both start with v=spf1 make SPF fail for all your mail.

6. Check the records

dig +short TXT default._domainkey.example.com
dig +short TXT example.com

Once the records are visible (usually within minutes, at most the record's TTL), reload Email Deliverability in cPanel: the domain should show as valid. Then send a test message to a Gmail address and check that the headers show dkim=pass and spf=pass.

Don't click "Generate Local DKIM Key" after publishing the record unless you intend to replace the key: a new key means you must update the DKIM record at your DNS provider again.

Next step: add a DMARC record at the same DNS provider (see how to publish DMARC and tighten the policy safely). Using Google Workspace for mail? See Google Workspace DNS records (MX, SPF, DKIM, DMARC).

Official documentation: Email Deliverability in cPanel and Cloudflare: create DNS records.