How to Set Up SPF, DKIM and DMARC for Your Domain

If your emails land in spam, the cause is often missing or incorrect SPF, DKIM or DMARC records on your domain. These are DNS records that tell receiving mail servers that your email is genuine. This guide explains what each record does and how to add them in your control panel.

Why Email Lands in Spam

Email providers such as Gmail, Outlook and Yahoo check SPF, DKIM and DMARC to confirm that a message really came from the domain it claims to be from. If these records are missing or wrong, your email can look suspicious and be filtered to spam or junk.

Passing these checks does not guarantee inbox delivery. Other factors, such as the content of your messages and the reputation of the sending server, also affect where email is placed.

What Each Record Does

SPF (Sender Policy Framework) lists the mail servers that are allowed to send email for your domain. Mail sent from anywhere else fails the check. Without an SPF record, anyone can send email that appears to come from your domain.

DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. The receiving server looks up the public key in your DNS and checks the signature. A failed check means the message was altered or forged.

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with email that fails SPF or DKIM: take no action, quarantine it (send it to spam) or reject it. It can also send you reports, so you can see who is sending email using your domain.

Check Your Current Records

Before you make changes, check which records already exist. You can use the MXToolbox website for this.

• For SPF, select SPF Lookup and enter your domain.
• For DKIM, select DKIM Lookup and enter default._domainkey.yourdomain.com, replacing yourdomain.com with your domain.
• For DMARC, select DMARC Lookup and enter your domain.

If any lookup returns "Not found" or an error, follow the steps below for that record.

Set Up SPF, DKIM and DMARC

cPanel

In cPanel, SPF and DKIM are managed from Email Deliverability. Your panel may show slightly different labels.

1. Log in to cPanel.
2. Go to Email and then Email Deliverability.
3. Click Manage next to your domain.
4. Check the SPF status. If it is invalid or missing, click Repair.
5. Check the DKIM status. If DKIM is not enabled, click Enable or Repair. cPanel creates the key and adds the DNS record for you.
6. To add DMARC, go to Domains and then Zone Editor.
7. Click Manage next to your domain.
8. Click Add Record and set the type to TXT.
9. Set the name to _dmarc.
10. Enter the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, replacing you@yourdomain.com with your own email address.
11. Click Save.

DirectAdmin

DirectAdmin labels can vary by version. If you cannot find an option, check your welcome email or the client area at my.hostking.host.

Set up SPF

1. Log in to DirectAdmin.
2. Click DNS Management.
3. Select your domain.
4. Look for an existing TXT record that contains v=spf1.
5. If one exists, click it and edit it. Do not add a second SPF record.
6. If none exists, click Add Record.
7. Set the type to TXT.
8. Set the name to @, which represents your root domain.
9. Enter your SPF value. Your SPF value depends on the services that send email for your domain. Get the correct value from your welcome email or the client area.
10. Click Save.

Set up DKIM

1. Log in to DirectAdmin.
2. Go to E-Mail Manager and look for DKIM. The option may appear as E-mail Accounts then Enable DKIM, or as DKIM Management.
3. Click Enable DKIM for your domain.

DirectAdmin generates the key pair and adds the DKIM record to your domain's DNS.

Set up DMARC

1. Log in to DirectAdmin.
2. Click DNS Management and select your domain.
3. Click Add Record.
4. Set the type to TXT.
5. Set the name to _dmarc.
6. Enter the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, replacing you@yourdomain.com with your own email address.
7. Click Save.

This sets a "monitor only" DMARC policy. It does not block any email yet. It sends you reports, so you can check that SPF and DKIM are working.

After you have confirmed that legitimate email passes checks (allow a week or two), you can change p=none to p=quarantine or p=reject for stronger protection.

Check Your Records After Changing Them

DNS changes can take up to 24 hours to spread across the internet, although most take effect within 30 to 60 minutes. Wait a few hours before you test again.

To test your setup:

• Run the SPF, DKIM and DMARC lookups on MXToolbox again.
• Send a test email from your domain to a Gmail address and check whether it arrives in the inbox.
• Check the message headers. Look for spf=pass, dkim=pass and dmarc=pass.
• You can also send a test email to mail-tester.com, which gives a score out of 10 and lists any problems it finds.

Troubleshooting

"SPF record already exists" error

A domain can have only one SPF record. Multiple SPF records cause checks to fail. Edit the existing record instead of adding a new one.

DKIM option is not visible

Check the labels listed in the steps above. If you still cannot find the option, contact support using live chat on the website or open a ticket from the client area at my.hostking.host.

Email still goes to spam

Check that the records exist at your DNS provider. If your DNS is hosted elsewhere, such as Cloudflare, add the records there. Your control panel cannot change records at an external provider.

Forwarding email can also break DKIM checks. If your email is forwarded, test a message sent directly to a Gmail address.

If the test results are still poor, contact support with the results from MXToolbox or mail-tester.com.

Need More Help?

Contact support using live chat on the Hostking website, or open a ticket from the client area. For prices, see the pricing page.