Advanced Email Deliverability: SPF, DKIM, and DMARC

If your emails keep landing in spam, the problem usually isn’t what you’re writing. It’s whether inbox providers trust your domain in the first place. If your domain is missing SPF, DKIM, or DMARC records, major inbox providers have every reason to treat your messages with suspicion, regardless of what’s inside them.

Google and Yahoo made this official with their bulk sender requirements in February 2024, and Microsoft followed on May 5, 2025, requiring all domains sending 5,000 or more emails per day to Outlook, Hotmail, and Live.com addresses to comply. Non-compliant messages are currently routed to Junk, and if the problem continues, these messages will eventually be rejected.

If you’ve been trying to fix emails going to spam without touching your DNS records, you’re solving the wrong problem. This guide covers everything you need to configure SPF, DKIM, and DMARC correctly on cPanel hosting with the practical detail and sequencing that actually matter.

What You’ll Learn

• What SPF, DKIM, and DMARC each do, and how they work together as a layered system.
• How to configure SPF and DKIM using cPanel’s Email Deliverability tool
• How to manually add a DMARC TXT record via cPanel’s Zone Editor.
• Why DMARC must be rolled out in stages, and what happens if you skip straight to enforcement.
• What the Microsoft 2025 sender requirements mean for your domain’s deliverability.
• The most common SPF, DKIM, and DMARC misconfigurations to avoid.

Why Email Authentication Is No Longer Optional

For a long time, email authentication was something many businesses knew they should set up, but often pushed down the priority list. That changed in 2024, and inbox providers have been tightening the rules ever since.

Google and Yahoo introduced formal bulk-sender requirements in February 2024, mandating SPF, DKIM, and a DMARC record with a p=none policy for any domain sending 5,000 or more emails per day. From November 2024 onward, Gmail moved beyond warnings: non-compliant senders now face temporary deferrals or permanent rejections rather than just reduced inbox placement.

Microsoft made the same move on May 5, 2025, applying identical requirements to bulk senders targeting Outlook, Hotmail, and Live.com addresses. Microsoft’s message is pretty clear: even if you’re not sending thousands of emails a day, proper authentication is becoming a requirement rather than a recommendation.

The compliance picture in brief:

Provider	Enforcement Date	Threshold	Current Consequence
Gmail (Google)	February 2024	5,000+ emails/day	Rejections; non-bulk senders face increased filtering
Yahoo Mail	February 2024	5,000+ emails/day	Rejections; non-bulk senders face increased filtering
Outlook / Hotmail / Live (Microsoft)	May 5, 2025	5,000+ emails/day	Routed to Junk; full rejection coming

In other words, email authentication isn’t a nice-to-have anymore. It’s a deliverability baseline that every domain sending professional email needs to meet. Setting up business email hosting on a properly authenticated domain is now the starting point, not an advanced step.

How SPF, DKIM, and DMARC Work Together

These three protocols operate as a layered authentication system. Each one addresses a different vulnerability, and together they cover the gaps that any single protocol leaves open.

SPF: Sender Policy Framework

SPF is a DNS TXT record that lists every mail server authorized to send email on behalf of your domain. When a receiving mail server gets a message claiming to be from your domain, it checks your SPF record to confirm the sending server’s IP address is on the approved list. If it isn’t, the message fails SPF. The record lives in your domain’s DNS, and the receiving server checks it automatically. No software installation required on either end.

DKIM: DomainKeys Identified Mail

DKIM takes a different approach. Instead of checking where a message came from, it checks whether the message was tampered with in transit. Your mail server attaches a cryptographic signature to every outgoing email.

The receiving server retrieves your public key from a DNS TXT record and uses it to verify the signature. If the message was modified after it left your server, for example, by a spam filter, a mailing list, or a malicious actor, the signature breaks and DKIM fails.

DMARC: Domain-based Message Authentication, Reporting and Conformance

DMARC sits on top of both. It tells receiving servers what to do when a message fails SPF, DKIM, or both: monitor and do nothing (p=none), send to spam (p=quarantine), or block entirely (p=reject). It also sends aggregate reports back to the domain owner, giving you visibility into who’s sending email on your behalf and whether authentication is passing or failing.

Why You Need All Three

To improve email deliverability, you need all three protocols in place. Here’s why:

• SPF fails on forwarded email because the forwarding server’s IP isn’t in your SPF record.
• DKIM survives forwarding but can break if an intermediary modifies the message body.
• DMARC only requires one of the two to pass, so the layered approach means your authentication holds even when a single protocol fails on a legitimate message.

Removing any one of them creates a gap that the other two can’t fully close.

SPF, DKIM, and DMARC Setup Guide

Setting Up SPF in cPanel

On Host4Geeks cPanel hosting, SPF configuration is handled through the Email Deliverability tool, provided your DNS is managed on the same server (i.e., you’re using Host4Geeks nameservers). Here’s the process:

1. Log in to cPanel and navigate to the Mail section. Click Email Deliverability.
2. Review the status for each domain listed. If SPF shows a warning or error, click Repair. cPanel will automatically generate and install the correct SPF record.
3. If your DNS is managed externally, for example, through Cloudflare or another registrar, the Repair button won’t apply records directly. Instead, copy the suggested record from cPanel and add it manually as a TXT record at your DNS provider.
4. A standard SPF record looks like this: v=spf1 a mx ~all. This authorizes the domain’s A record and MX servers to send mail. If you use third-party services like Mailchimp or Google Workspace, their include statements get added to the same record.

Two rules to follow without exception:

• A domain can only have one SPF record. If you already have a TXT record starting with v=spf1, edit it, but do not add a second one. Two SPF records cause both to fail.
• The SPF 10-lookup limit. Every include: and redirect: directive in your SPF record counts as one DNS lookup. Exceed 10 and authentication silently fails. If you use multiple third-party sending services, consider an SPF flattening tool to keep the number of lookups within the limit.

Setting Up DKIM in cPanel

DKIM is also configured through cPanel’s Email Deliverability tool. Key pair generation is handled automatically; no cryptographic knowledge required.

1. In the Email Deliverability tool, locate the DKIM section for your domain. If the status shows an issue, click Install the Suggested Record.
2. cPanel generates a 2048-bit DKIM key pair, the current recommended minimum, and installs the public key as a DNS TXT record automatically when you’re using Host4Geeks nameservers.
3. If DNS is managed externally, copy the DKIM TXT record from cPanel, which contains a long public key string, and add it manually at your DNS provider. The record name follows the format default._domainkey.yourdomain.com.
4. Allow up to 24–48 hours for DNS propagation, then return to the Email Deliverability tool to confirm the status shows as valid. You can also send a test message to mail-tester.com for an independent score.

Setting Up DMARC in cPanel

DMARC is the one protocol that cPanel’s Email Deliverability tool does not configure automatically. It requires a manual TXT record added through Zone Editor. This is straightforward, but the sequencing matters. It can be tempting to go straight to the strongest DMARC setting, but doing so too early can block legitimate emails from reaching customers.

Adding the DMARC Record

1. In cPanel, navigate to Domains → Zone Editor.
2. Click Manage next to your domain, then select Add Record → TXT Record.
3. Set the Name to _dmarc.yourdomain.com, the TTL to 14400, and paste the DMARC value into the record field.
4. Start with a monitoring-only policy: v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Replace the email address with one you actively monitor, and aggregate reports will start arriving within a few days.
5. Save the record and allow up to 24 hours for propagation.

DMARC Rollout Stages

Do not skip directly to p=reject. If SPF or DKIM isn’t fully verified across all your sending services, a strict policy will block legitimate email, including transactional messages, newsletters, and helpdesk notifications.

The staged approach is how you lock down the domain without collateral damage.

Phase	Policy	What Happens	Duration
Phase 1: Monitor	p=none	Reports collected; no impact on delivery	2–4 weeks
Phase 2: Quarantine	p=quarantine	Failed messages routed to spam; start at pct=25 and increase gradually	2–4 weeks
Phase 3: Reject	p=reject	Failed messages blocked entirely; maximum protection	Ongoing

Review your aggregate reports during Phase 1 before moving forward. They’ll show you exactly which servers are sending email on your behalf, which are passing, and which aren’t, giving you the information you need to fix any gaps before tightening the policy.

Verifying Your Setup

Don’t assume everything is working just because the records were added. A few quick checks can confirm your setup is doing what it’s supposed to.

• cPanel Email Deliverability tool: SPF and DKIM status should display as Valid with green indicators. This is your first check.
• mail-tester.com: Send a test email to the address provided and receive a deliverability score out of 10. It flags specific authentication failures clearly and is one of the most useful quick checks available.
• MXToolbox: Free online lookup and validation for SPF, DKIM, and DMARC records. Good for confirming records have propagated and are syntactically correct.
• Gmail header check: Send a test email to any Gmail address, open it, click the three-dot menu, and select Show original. Look for SPF: PASS, DKIM: PASS, and DMARC: PASS in the authentication results section.
• DMARC aggregate reports: Monitor the reports arriving at your RUA address for the first two to four weeks. They identify unauthorized senders and misconfigured services before they become a deliverability problem.

Common SPF, DKIM, and DMARC Mistakes

To improve email deliverability, it’s essential to avoid making setup mistakes. Most of the failures come down to a few repeatable mistakes.

Here’s what to watch for when following this SPF DKIM DMARC setup guide:

• Multiple SPF records: Two TXT records beginning with v=spf1 cause both to fail immediately. Check your DNS for existing records before adding a new one. If one exists, merge the entries into a single record.
• Exceeding the 10-lookup limit: Every include: directive in your SPF record consumes one lookup. Services like Google Workspace, Mailchimp, HubSpot, and Zendesk each add their own. If you’re running multiple third-party email tools, you can hit the limit quickly. Use an SPF flattening tool to consolidate lookups.
• Jumping straight to DMARC p=reject: Without first running a monitoring phase, you have no way of knowing whether all your legitimate sending sources are authenticated. Skipping the p=none and p=quarantine stages risks blocking transactional email, marketing campaigns, and helpdesk notifications.
• Missing third-party senders from SPF: If Mailchimp, HubSpot, Zendesk, or any other service sends email on your domain’s behalf, their sending servers must be included in your SPF record. Their documentation will tell you which include: statement to add.
• Ignoring DMARC aggregate reports: The reports sent to your RUAs’ address are the feedback loop that the entire monitoring phase depends on. If you’re not reading them, you’re operating in the dark, and you’ll miss unauthorized senders or authentication failures that need fixing before you tighten your policy.

Getting these details right is also part of a broader approach to website security practices. Email authentication closes a significant attack surface for domain spoofing and phishing.

What Comes Next — BIMI

Once your DMARC policy is at p=quarantine or p=reject, you’re eligible to implement BIMI (Brand Indicators for Message Identification). BIMI is another layer of email authentication that displays a verified brand logo directly in the recipient’s inbox alongside authenticated messages.

BIMI is supported by Gmail, Yahoo Mail, Apple Mail, and Fastmail, though Outlook does not currently support it.

Important Note: Gmail and Apple Mail require either a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC) to display the logo. A BIMI DNS record alone isn’t sufficient for those providers.

Important Note: Gmail and Apple Mail require either a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC) to display the logo. A BIMI DNS record alone isn’t sufficient for those providers.

Get Your Email Authentication Right From the Start

If you want your emails to consistently reach inboxes, SPF, DKIM, and DMARC need to be part of your setup. They’re the authentication baseline that Google, Yahoo, and Microsoft now require.

The setup is straightforward on cPanel hosting: the Email Deliverability tool handles SPF and DKIM with a single Repair action, and DMARC is a manual TXT record in Zone Editor. Rolling out DMARC gradually takes a little patience, but it helps you strengthen security without disrupting legitimate email.

At the infrastructure level, Host4Geeks’ SecureStack server hardening includes active anti-spam IP monitoring to protect the sending reputation of server IPs, which matters as much as your DNS records when inbox providers evaluate your messages.

If you need help with DNS record configuration or want an expert to review your current setup, the Host4Geeks support team is available around the clock.

Ready to lock down your domain’s email authentication? Explore our hosting plans or contact support to get started.

Frequently Asked Questions

What is the difference between SPF, DKIM, and DMARC?

SPF verifies that the server sending your email is authorized to do so by checking it against an approved list in your DNS. DKIM adds a cryptographic signature to outgoing messages to confirm they haven’t been modified in transit. DMARC uses both checks to enforce a policy and sends you reports on the results. All three are needed because each one covers gaps the others leave open.

Why are my emails going to spam even though I have SPF set up?

SPF alone isn’t enough anymore. If DKIM is missing or misconfigured, many inbox providers will still route messages to spam, particularly after the 2024–2025 enforcement changes from Google, Yahoo, and Microsoft. SPF also fails on forwarded email. Fixing emails going to spam typically requires all three protocols to be correctly configured and passing.

Does cPanel set up DMARC automatically?

No. cPanel’s Email Deliverability tool handles SPF and DKIM automatically via the Repair or Install Suggested Record options. DMARC is not configured automatically. It requires a manual TXT record added through cPanel’s Zone Editor. Set the record name to dmarc.yourdomain.com and start with p=none to begin the monitoring phase before moving to a stricter policy.

How long does DNS propagation take after adding authentication records?

DNS changes typically propagate within a few hours, but full propagation can take up to 24–48 hours depending on your TTL settings and DNS provider. After adding SPF, DKIM, or DMARC records, wait at least a few hours before verifying with tools like MXToolbox or mail-tester.com. DMARC aggregate reports can take a day or two to start arriving at the address you specified in the RUA tag.

What is the SPF 10-lookup limit, and how do I fix it?

The SPF specification caps the number of DNS lookups a receiving server will perform when evaluating your record at 10. Every include: or redirect: directive triggers a lookup, so if you’re using multiple third-party email services, you can exceed the limit without realizing it, causing silent authentication failures. Fix it by using an SPF flattening tool, which replaces include: references with the actual IP addresses they resolve to, reducing lookup count to zero.

What does a DMARC aggregate report tell me?

DMARC aggregate reports, sent in XML format to the email address in your RUA tag, show you every source that sent email using your domain during the reporting period, along with whether each message passed or failed SPF and DKIM. They identify unauthorized senders, misconfigured services, and forwarding issues. Reviewing these reports during the p=none monitoring phase is how you confirm your authentication is fully working before tightening your DMARC policy.