cPanel Email Deliverability: How to Check and Fix SPF and DKIM Records

Updated: 29 September 2026 · Applies to: cPanel & WHM 138 (Jupiter theme), Email Deliverability

SPF and DKIM prove to other mail servers that email from your domain really comes from you. Without them, your messages are more likely to land in spam, and it is easier for someone else to send fake mail in your name. In cPanel you check and fix both in one place: Email Deliverability. (The older "Authentication" icon no longer exists.)

• SPF is a DNS record that lists the servers allowed to send mail for your domain.
• DKIM adds a digital signature to each message. Receiving servers check it against a public key published in your DNS.
• DMARC tells receiving servers what to do with mail that fails those checks, and where to send reports.

Check your domains

1. Log in to cPanel and open Email › Email Deliverability.
2. The table lists each domain with its Email Deliverability Status. Domains with problems show which records are missing or wrong.

If you don't see Email Deliverability in your cPanel, ask our support team.

If your domain uses our nameservers: Repair

1. Click Repair next to the domain.
2. Review the suggested records (you can copy or customise them) and approve the repair.
3. Changes can take up to five minutes. Reload the page and the status should be valid.

Repair is only offered when our server controls the domain's DNS.

If your DNS is hosted elsewhere (Cloudflare, your registrar and so on)

cPanel can't change records on another provider's nameservers. Click Manage, copy the suggested DKIM and SPF records, and add them at your DNS provider. Step-by-step instructions, including Cloudflare: how to add cPanel SPF and DKIM records when your DNS is at Cloudflare or your registrar.

What Manage shows

• DKIM: the Suggested "DKIM" (TXT) Record with its Name (default._domainkey.example.com) and Value. The value is long; Full shows it in one piece, and Split shows it in 255-character parts for DNS providers that don't split long records themselves.
• SPF: the suggested record, for example v=spf1 +a +mx +ip4:203.0.113.10 ~all, which allows your domain's own server to send. Customize lets you add other senders, such as an include: for a newsletter service or Google Workspace.
• Reverse DNS (PTR): shown only when there is a problem. The PTR record belongs to whoever controls the IP address, so on our hosting servers that is us: open a support ticket if it is flagged.

One SPF record per domain

A domain must have only one SPF record (one TXT record starting with v=spf1). If you send mail through several services, combine them in one record, for example:

v=spf1 +a +mx +ip4:203.0.113.10 include:_spf.google.com ~all

Two separate SPF records make SPF fail for everything.

Add DMARC

Once SPF and DKIM are valid, add a DMARC record. Start in monitoring mode with a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

When the reports show that all your real mail passes, tighten it to p=quarantine and later p=reject. More detail: how to publish DMARC and tighten the policy safely.

Test

Send a message to a Gmail or Outlook address and open the original message: the headers should show spf=pass, dkim=pass and, once published, dmarc=pass. See also how to test authentication and deliverability of your outgoing email.

Official documentation: Email Deliverability in cPanel.