SPF, DKIM and DMARC Explained: Stop Your Email Landing in Spam

If your emails keep landing in spam, missing DNS authentication records are the usual reason. Gmail and Microsoft now expect every sending domain to prove it’s legitimate, and they do that by checking three records: SPF, DKIM and DMARC. Here’s what each one does and how to get them right.

SPF: who’s allowed to send

SPF (Sender Policy Framework) is a single DNS TXT record that lists the servers permitted to send mail for your domain. When a receiving server gets a message from you, it checks whether the sending IP appears in your SPF record. A basic record for a Hostnasi-hosted domain looks like this:

v=spf1 +a +mx +ip4:YOUR_SERVER_IP ~all

The ~all at the end tells receivers to treat mail from unlisted servers as suspicious but not to reject it outright. Only ever publish one SPF record per domain — two will break authentication entirely.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The receiving server fetches your public key from DNS and confirms the message wasn’t altered in transit and really came from your domain. In cPanel this is a one-click job under Email Deliverability — the panel generates the key pair and shows you the exact TXT record to publish if it isn’t applied automatically.

DMARC: the policy that ties it together

DMARC tells receiving servers what to do when SPF or DKIM fails, and where to send reports. A gentle starting policy is:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none so you can watch the reports without blocking legitimate mail. Once you’re confident everything authenticates, tighten it to p=quarantine and eventually p=reject.

Checking your work

cPanel’s Email Deliverability page shows a green tick next to each record when it’s valid. If you see a warning, cPanel gives you the exact record to copy into your DNS zone. After publishing, allow up to a few hours for DNS to propagate, then send a test to a Gmail address and open Show original to confirm all three read PASS.

Get these three right and your delivery rates climb noticeably. If you’d rather we configure and verify them for you, that’s a standard part of what we do — just ask.