Enable SPF and DKIM for cPanel Email Domains

cPanel Email Deliverability helps inspect SPF and DKIM DNS data for domains managed by the account. These mechanisms support mail authentication; they do not guarantee that nobody can spoof a visible From address or that legitimate mail reaches every inbox.

Inventory every legitimate sender

Identify the actual services sending for the domain, including website applications, mailbox SMTP and third-party platforms. A cPanel suggestion may describe this server, not every external service. Preserve the current TXT records and signing configuration before approving changes.

Use the current interface

1. Open the verified HTTPS cPanel account and Email > Email Deliverability. The older Authentication screen is not the current interface.
2. Choose the exact domain and use Manage to review the suggested SPF and DKIM names/values and current status.
3. If Repair is offered, inspect its proposed changes before confirming. Merge legitimate sending requirements into one SPF policy instead of adding a second v=spf1 record at the same owner name.
4. Publish only the public DKIM material for the provider’s actual selector. Never put a private signing key into DNS, screenshots or a support message.
5. Recheck the published values and a signed message sent through each intended route.

External DNS needs external publication

If the domain uses Cloudflare or other authoritative nameservers outside this server, a local install does not update that public zone. Copy the exact public record name/value to the authoritative provider, following its formatting rules. Do not delete unrelated TXT verification records or reset the whole zone to make the status green.

When mail is sent by a separate provider, use that provider’s own selector and authorization instructions. Publishing a key does not prove the sender actually signs, and checking a guessed default selector cannot establish that no other DKIM selector exists.

Verify identity and policy separately

SPF evaluates the SMTP envelope/HELO identity; DKIM verifies a domain signature over selected message data. DMARC adds alignment to the visible From domain. Inspect trusted receiver authentication results and delivery errors; do not infer success solely from a DNS row or interpret authentication as proof a message is benign.

References: cPanel Email Deliverability, SPF and DKIM.

Reviewed October 15, 2026. Documentation review only; no customer TXT record, signing key or mail service was changed or tested.