SPF, DKIM and DMARC are DNS-based controls that help receiving mail systems evaluate whether messages claiming to come from your domain are legitimate.
Step by step
- Use cPanel Email Deliverability to inspect SPF and DKIM for domains that send mail from the hosting server.
- SPF lists the systems allowed to send mail for a domain; avoid publishing multiple separate SPF records.
- DKIM adds a cryptographic signature that receivers can validate using a DNS public key.
- DMARC tells receivers how to handle messages that fail aligned SPF/DKIM checks and can send aggregate reports.
- Start DMARC cautiously with monitoring, then strengthen policy after you know every legitimate sender is covered.
Important
A strict DMARC policy added before third-party senders are configured can cause legitimate mail to be rejected. Inventory website forms, marketing platforms and external mail providers first.
Checks and troubleshooting
If mail lands in spam, authentication is only one factor. Check message content, sending reputation, reverse DNS where relevant and the exact rejection/bounce response.