How to add SPF, DKIM & DMARC records in cPanel

Email authentication is three DNS records — an SPF TXT record, a DKIM record (usually a CNAME), and a DMARC TXT record. In cPanel you add all three from the Zone Editor. The main thing to know: cPanel’s Zone Editor uses a fully-qualified Name field, so you type the whole host including your domain and a trailing dot. This guide walks through each record with a worked example.

Written & reviewed by the VerifyAnyEmail team · Last reviewed July 2026

cPanel is the control panel many shared-hosting accounts use. You don’t need to be technical — a DNS record is just a labelled line stating a fact about your domain, and for email you add three of them from one screen called the Zone Editor.

TXT vs CNAME, and “Name” vs “Record”

Two record types matter:

  • A TXT record holds text. SPF and DMARC are both TXT — the text is the policy.
  • A CNAME record is a pointer that says “for this name, look at that other name instead.” Mail providers usually give DKIM as a CNAME so they can rotate the key behind the scenes.

cPanel calls the fields Name (the host) and Record (the value). The important difference from most registrars: cPanel expects a fully-qualified Name — you type the whole thing including your domain and a trailing dot, e.g. example.com. for the root or _dmarc.example.com. for a subdomain. cPanel usually pre-fills the domain suffix for you, but always check the trailing dot is there.

1. Open the Zone Editor

Log in to cPanel, scroll to the Domains section, and click Zone Editor. Find your domain in the list and click Manage. You’ll see the existing records and an + Add Record dropdown. cPanel’s official Zone Editor documentation is here. (If your domain’s nameservers point away from this host, the records must be edited wherever the nameservers live instead.)

2. Add the SPF record (a TXT at the root)

SPF lists the servers allowed to send mail as your domain. Click + Add Record → Add TXT Record (some versions: choose Type = TXT) and set:

  • Name: example.com. (the root domain, with the trailing dot)
  • TTL: leave the default (e.g. 14400)
  • Record: v=spf1 +a +mx include:_spf.google.com ~all

Click Save Record. Rule: only one SPF record. If a TXT with v=spf1 already exists (shared hosts often add one for the server’s own mail — note the +a +mx), edit that record and merge in the new include: rather than adding a second. Build a clean string with the SPF Generator.

3. Add the DKIM record (CNAME, or TXT)

DKIM lets your mail provider sign each message. If cPanel handles your mail itself, it can generate DKIM for you under Email → Email Deliverability — use that if it’s offered. If an external provider gave you a DKIM record, add it here. For a CNAME, click + Add Record → Add CNAME Record and set:

  • Name: the selector plus your domain, e.g. selector1._domainkey.example.com.
  • Record (CNAME / target): the target given, e.g. selector1-example-com._domainkey.provider.com

If your provider gave DKIM as a TXT record instead, choose Add TXT Record, put the selector name (e.g. default._domainkey.example.com.) in Name, and paste the long v=DKIM1; k=rsa; p=… value into Record. cPanel handles the length. Verify later with the DKIM Checker.

4. Add the DMARC record (a TXT at _dmarc)

DMARC ties SPF and DKIM to the visible From address and tells inboxes what to do on failure. Click + Add Record → Add DMARC Record if your version offers the guided form (it builds the record for you), or add a plain TXT with:

  • Name: _dmarc.example.com.
  • Record: v=DMARC1; p=none; rua=mailto:dmarc@example.com

Start with p=none to monitor without affecting delivery, and point rua= at a mailbox you check. Generate one with the DMARC Generator and validate it with the DMARC Checker. When ready to enforce, follow moving DMARC to reject safely.

cPanel-specific gotchas

  • Fully-qualified names with a trailing dot. Use _dmarc.example.com., not just _dmarc. Missing the trailing dot can make cPanel append the domain again.
  • Use Email Deliverability if it’s there. For mail hosted on the same server, cPanel’s Email Deliverability page auto-generates and repairs SPF and DKIM — let it, rather than hand-editing.
  • One SPF record only. Merge with any existing +a +mx record; don’t duplicate.
  • Nameservers must point here. Zone Editor only controls DNS if this host is authoritative for the domain.

Verify propagation

After saving, confirm the records are visible worldwide with the DNS Propagation Checker, then check each individually with the SPF Checker, DKIM Checker and DMARC Checker. To confirm all three together, run the Email Health Check.

For what each record does and how DMARC alignment decides a pass, read the complete SPF, DKIM & DMARC guide. Using a different registrar? See the equivalents for Cloudflare, GoDaddy, Namecheap, AWS Route 53 and Squarespace.

Check your domain in seconds

Run the free diagnostics referenced in this guide — no sign-up needed.

Email Health CheckAll tools

More guides

🧹 How to Clean an Email List Before a Campaign (2026 guide)
A step-by-step workflow to dedupe, validate and verify a list before you hit send — and keep bounces low.
🔬 How Email Verification Works (Without Sending an Email)
Syntax → MX → live SMTP probe → catch-all/role/disposable checks: the real pipeline, explained.
🚦 Deliverable, Risky, Catch-All & Unknown: How to Handle Every Verification Result
What each verification status means and the safe action to take — from sign-up forms to bulk sends.
🎯 Should You Send to Catch-All Emails? (2026)
Catch-all domains accept everything, so SMTP can’t confirm the mailbox. A practical decision framework.