SPF, DKIM and DMARC Explained: A Business Email Deliverability Guide
Set up a professional business email but noticing your messages land in spam, or bounce entirely? The most common cause is missing or misconfigured email authentication records - specifically SPF, DKIM and DMARC. Here's what each one does and how to set them up.
Why Email Authentication Matters
Anyone can technically send an email pretending to be "from" your domain - this is how a huge share of phishing and spam works. SPF, DKIM and DMARC are DNS records that prove to receiving mail servers (Gmail, Outlook, Yahoo, etc.) that an email genuinely came from your domain's authorized servers, not an impersonator. Without them, legitimate emails from your own business domain can get flagged as spam or rejected outright, since receiving servers can't verify they're genuine.
SPF (Sender Policy Framework)
SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When you send an email, the receiving server checks your domain's SPF record to confirm the sending server is on the approved list.
A typical SPF record for hosting-based email looks like:
v=spf1 include:hostira.co ~all
This is added as a TXT record in your domain's DNS settings. Your hosting provider can tell you the exact value to use for your mail server.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to every email you send, which the receiving server can verify against a public key published in your DNS. This confirms the email content hasn't been tampered with in transit and genuinely originated from your domain's mail server.
DKIM is usually enabled from your cPanel's Email Deliverability section, which generates the correct DNS record for you to add - you don't need to write it manually.
DMARC (Domain-based Message Authentication)
DMARC builds on top of SPF and DKIM. It tells receiving servers what to do if an email fails SPF or DKIM checks (reject it, quarantine it as spam, or just monitor and report), and where to send reports about authentication failures.
A basic starting DMARC record looks like:
v=DMARC1; p=none; rua=mailto:support@hostira.co
Starting with p=none (monitor only) is recommended so you can review reports before moving to stricter enforcement (p=quarantine or p=reject), which could otherwise block your own legitimate email if something is misconfigured.
How to Set These Up in cPanel
- Log in to cPanel and find Email Deliverability under the Email section
- Select the domain you want to configure
- cPanel will show you the exact SPF, DKIM and DMARC records it recommends, comparing them to what's currently published
- Click "Install" or "Repair" next to any record that's missing or misconfigured - cPanel adds it to your DNS automatically if your domain's DNS is hosted with the same provider
- If your domain's DNS is managed elsewhere (a different registrar), copy the exact record values shown and add them manually in that registrar's DNS management panel
Need Help With Email Deliverability?
Hostira's cPanel includes a built-in Email Deliverability checker that reviews your SPF, DKIM and DMARC status automatically. If you're unsure about any step, our support team can help you get it configured correctly.
Contact Support →How to Check If It's Working
After setup, send a test email to a Gmail address and check the message's original/raw headers (in Gmail: More options → Show original). Look for "SPF: PASS," "DKIM: PASS" and "DMARC: PASS." Free tools like mail-tester.com also let you send a test email and get a full deliverability score with specific fixes.
Conclusion
SPF, DKIM and DMARC aren't optional extras for serious business email - they're the difference between your emails reliably reaching the inbox and quietly landing in spam or bouncing. The good news is that cPanel's Email Deliverability tool does most of the technical heavy lifting; you mostly just need to know these three names and click "install."
