Mailbox providers check that mail claiming to be from your domain was sent by a server you authorised. SPF and DKIM are those checks. DMARC tells them what to do on failure.
SPF
If the domain uses our nameservers, cPanel usually adds an SPF TXT record for the local mail server. In Zone Editor you should see a TXT on the apex similar to v=spf1 +a +mx +ip4:YOUR_IP ~all. Do not add a second SPF record — merge includes into one.
DKIM
cPanel → Email Deliverability (or Authentication). Enable DKIM for the domain. That publishes a TXT selector (often default._domainkey). Wait for DNS, then send a test to Gmail and open “Show original” to confirm DKIM pass.
Enterprise email plans include DKIM as a standard feature. On other mailboxes you still enable it in cPanel as above.
DMARC (optional next step)
Add a TXT record on _dmarc.yourdomain.com starting with v=DMARC1; p=none; so you can monitor before you enforce. Tighten to p=quarantine when reports look clean.
If you send through Google Workspace or Microsoft 365 instead of cPanel mail, use that provider’s SPF include and DKIM wizard — not our local DKIM.
Was this article helpful?
Your feedback helps us prioritize guides that need work.