--- title: "How to Set Up DMARC in cPanel: Complete SPF, DKIM & DMARC Configuration Guide | AutoSPF" description: "Learn how to set up DMARC in cPanel with SPF and DKIM, add a DMARC TXT record, prevent email spoofing, and improve email deliverability." image: "https://autospf.com/og/blog/how-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide.png" canonical: "https://autospf.com/blog/how-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide/" --- Quick Answer To set up DMARC in cPanel, first enable SPF and DKIM, then add a DMARC TXT record in the Zone Editor. Start with p=none to monitor reports, verify DNS propagation, and move to p=quarantine or p=reject to stop email spoofing and improve deliverability. ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20to%20Set%20Up%20DMARC%20in%20cPanel%3A%20Complete%20SPF%2C%20DKIM%20%26%20DMARC%20Configuration%20Guide&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide%2F&title=How%20to%20Set%20Up%20DMARC%20in%20cPanel%3A%20Complete%20SPF%2C%20DKIM%20%26%20DMARC%20Configuration%20Guide "Share on Reddit") [ ](mailto:?subject=How%20to%20Set%20Up%20DMARC%20in%20cPanel%3A%20Complete%20SPF%2C%20DKIM%20%26%20DMARC%20Configuration%20Guide&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide%2F "Share via Email") ![Configure DMARC in cPanel](https://media.mailhop.org/autospf/spf-flatterning-5139-1784546925353.jpg) ## What DMARC Is and Why It Matters for cPanel Email Security DMARC, short for Domain-based Message Authentication, Reporting, and Conformance, is an email authentication protocol that tells receiving [mail servers](https://www.activecampaign.com/glossary/mail-server) how to handle messages that fail SPF or DKIM checks. In practical terms, a DMARC record helps protect your domain from email spoofing, **improves email deliverability**, and strengthens domain security by confirming whether a message is authorized to represent your sender identity. In a cPanel environment, DMARC works alongside an SPF record and a DKIM record. SPF verifies whether a sending server is allowed to send mail for your domain. DKIM adds a digital signature to outgoing messages so the recipient can confirm the message was not altered in transit. DMARC evaluates [SPF alignment](https://autospf.com/blog/why-spf-alignment-matters-in-dmarc-enforcement/) and DKIM alignment, then applies a policy such as **p=none, p=quarantine, or p=reject**. For businesses using cPanel with [Google Workspace](https://en.wikipedia.org/wiki/Google%5FWorkspace)**,** Microsoft 365, Gmail, or locally hosted mail, DMARC is essential for spoofing protection and **phishing prevention**. Without a valid DMARC record, attackers can impersonate your domain more easily, damaging email reputation and reducing trust with customers, vendors, and mailbox providers such as Google and Microsoft. A basic DMARC TXT record usually includes the protocol version `v=DMARC1`, a policy, and reporting addresses. For example, a monitor mode DMARC record may use `p=none` while you review email reporting data. Later, you can move toward policy enforcement with `p=quarantine` or `p=reject`. Reliable [email security](https://autospf.com/) depends on correct email authentication, clean DNS records, and **ongoing monitoring** of your mail flow.![Spf Record Check 1622](https://media.mailhop.org/autospf/spf-record-check-1622-1784547784920.jpg) ### Before You Begin: DNS Access, Email Sources, and Record Planning Before creating a DMARC record in cPanel, confirm where your DNS is hosted. _Some domains use the cPanel Zone Editor, while others use external DNS providers such as Cloudflare, GoDaddy, Microsoft, or Google._ If your nameserver points away from your hosting provider, adding a [TXT record](https://www.digicert.com/blog/what-is-a-txt-record) in cPanel may not affect live DNS. In that case, you must manage DNS records wherever the authoritative nameserver is located. You should also identify every **legitimate email source**. This may include cPanel-hosted mail, Google Workspace\*\*,\*\* Microsoft 365, [CRM](https://www.ibisworld.com/united-states/industry/crm-system-providers/4592/) platforms, marketing tools, billing systems, help desk platforms, or a subdomain used for transactional email. Missing a sender can cause SPF alignment or DMARC alignment failures and may disrupt mail flow once your policy becomes stricter. For proper record planning, document: - Your [domain TLD](https://en.wikipedia.org/wiki/Top-level%5Fdomain), such as `.com`, `.net`, or `.org` - Existing SPF record and DKIM record values - Whether you use CNAME records for hosted services - Which platform controls zone management - Whether **DMARC reporting** should go to your own mailbox or a service such as PowerDMARC _A hosted DMARC provider, including the PowerDMARC platform, can simplify reporting, record management, and verification._ The PowerDMARC portal, PowerSPF, and similar deliverability tool options are useful when you need visibility into authentication failures across multiple senders. ## How to Enable and Verify SPF and DKIM in cPanel Before adding a DMARC record, make sure SPF and DKIM are enabled. DMARC depends on **SPF and DKIM results**, so a broken spf record or dkim record can reduce email deliverability even if the DMARC record itself is syntactically correct.![Spf Records 5690](https://media.mailhop.org/autospf/spf-records-5690-1784548029178.jpg)In cPanel, the main interface for this is usually the Email Deliverability tool. This tool checks your domain security status and recommends email authentication records. Depending on your hosting provider, such as InMotion Hosting or another WHM-based host, cPanel may show warnings and provide an option to install suggested record entries automatically. ### Enable and Verify Your SPF Record Open [cPanel](https://cyberin.in/blog/what-is-cpanel-hosting-in-the-united-states/) and go to **Email > Email Deliverability**. Select the domain you want to review. If cPanel detects a missing or invalid spf record, it may display a suggested TXT record. The SPF record usually starts with `v=spf1` and lists permitted senders, such as your server IP address, Google Workspace\*\*,\*\* Microsoft 365, or another approved service. If your DNS is hosted in cPanel, you can use Install Suggested Record or add the SPF TXT record manually in the [Zone Editor](https://www.datarealm.com/clients/knowledgebase/2110/Zone-Editors.html). _If DNS is hosted externally, copy the record value and add it at Cloudflare, GoDaddy, or your current DNS provider._ #### SPF Record Name, Type, and Value For most [root domains](https://www.siteground.com/kb/what-is-a-root-domain/), the record name is your domain, such as `example.com`. The record type is TXT, the class is typically IN, and the record value contains the SPF mechanism. Avoid creating multiple SPF TXT records for the same hostname. **Multiple SPF records** can fail verification and harm email deliverability. A correct spf record supports domain security by proving that authorized servers are allowed to send for your domain. It also helps DMARC evaluate SPF alignment, which means the domain in the envelope sender aligns with the visible From domain. ### Enable and Verify Your DKIM Record DKIM is also managed from the Email Deliverability tool in cPanel. A DKIM record publishes a [public key](https://www.techtarget.com/searchsecurity/definition/public-key) in DNS, while your mail server signs outgoing messages with a private key. Receiving servers use the DNS key to validate the digital signature. If cPanel shows a missing dkim record, use Install Suggested Record when cPanel controls DNS. Otherwise, copy the generated record and create it with your external DNS provider. Some services publish DKIM as a TXT record, while others use a CNAME that points to a **provider-controlled hostname**.![Spf Lookup 3182](https://media.mailhop.org/autospf/spf-lookup-3182-1784548733472.jpg) #### DKIM Alignment and Digital Signature Checks [DKIM](https://autospf.com/blog/how-dkim-works-a-comprehensive-guide-to-email-authentication/) alignment matters because DMARC checks whether the DKIM signing domain aligns with the From domain. _If you use Google Workspace or Microsoft 365, confirm that the dkim record is generated inside the Google Admin console or Microsoft 365 admin center, then published in DNS._ After DNS propagation, send a test message to Gmail or another mailbox and inspect the message headers. Look for `dkim=pass`, `spf=pass`, and eventually `dmarc=pass`. This verification step confirms that your email authentication foundation is working before you apply a stricter **DMARC policy**. ## How to Create and Add a DMARC TXT Record in cPanel Zone Editor To create a DMARC record in cPanel, open **Domains > Zone Editor**. Locate your domain and click Manage. This opens the zone management interface where you can add record entries for TXT, CNAME, MX, and other [DNS record](https://www.cloudns.net/wiki/article/9/) types. Click Add Record and choose TXT as the record type. For the record name, enter: ``` _dmarc.example.com ``` Replace `example.com` with your actual domain. The record value should begin with the DMARC protocol version: ``` v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s ``` ![Kitterman Spf 9722](https://media.mailhop.org/autospf/kitterman-spf-9722-1784548203367.jpg)This creates a monitor mode DMARC record. The `p=none` policy tells receivers not to block mail yet, while still sending aggregate reporting data. The tags `adkim` and `aspf` define DKIM and SPF alignment modes. Strict alignment can **improve domain security**, but relaxed alignment may be safer during early deployment. Once you understand legitimate mail sources, you can change the policy to `p=quarantine`, which asks receivers to place failing messages in spam, or `p=reject`, which requests full rejection. This staged policy approach **protects mail flow** while gradually increasing [policy enforcement](https://www.rubrik.com/insights/policy-enforcement). For a subdomain, you can add a separate DMARC record or use DMARC inheritance from the organizational domain. Advanced deployments may use PowerDMARC, hosted DMARC, or another deliverability tool to generate a recommended TXT record and interpret email reporting data. A typical cPanel Zone Editor workflow looks like this: 1. Log in to cPanel. 2. Open Zone Editor. 3. Select **Manage for the domain**. 4. Choose Add Record. 5. Set the record type to TXT. 6. Enter`_dmarc` as the record name if cPanel appends the domain automatically. 7. Paste the DMARC record value. 8. Save and wait for [DNS propagation](https://www.digicert.com/faq/dns/what-is-dns-propagation). Be careful not to create duplicate DMARC record entries. Only one DMARC TXT record should exist at `_dmarc.yourdomain.com`. Duplicate records can cause verification failure and reduce email deliverability. ## Testing, Monitoring, and Troubleshooting Your DMARC Configuration ![Spf Flatterning 1229](https://media.mailhop.org/autospf/spf-flatterning-1229-1784548467593.jpg)After adding the TXT record, test your DMARC record with a [DNS lookup](https://www.ntchosting.com/encyclopedia/dns/lookup/) tool, a **DMARC checker**, or a platform such as PowerDMARC. You can also use cPanel Support documentation, WHM tools, and provider-specific guidance from Microsoft, Google, or your hosting company. Technical training resources from professionals such as Yunes Tarada, including [CompTIA A+](https://www.coursera.org/articles/what-is-the-comptia-a-certification-what-to-know) and [Azure Administrator Associate](https://eliteinternationaltraining.com/azure-administrator-associate) learning paths, can also help administrators understand DNS, authentication, and domain security fundamentals. _Check that the DMARC record returns correctly from public DNS. If it does not appear, confirm the authoritative nameserver, review the Zone Editor entry, and allow time for DNS propagation._ Also verify that the TXT record is not accidentally created under the wrong hostname, such as `_dmarc.example.com.example.com`. Common troubleshooting checks include: - **SPF record** returns `pass` for authorized senders. - DKIM record is published and messages show `dkim=pass`. - DMARC record starts with `v=DMARC1`. - The policy is valid: `p=none`, `p=quarantine`, or `p=reject`. - Reporting addresses are valid and able to receive aggregate reports. - SPF alignment and DKIM alignment match your sending architecture. - cPanel Zone Editor changes are made at the active DNS provider.![Spf Permerror 4100](https://media.mailhop.org/autospf/spf-permerror-4100-1784547068247.jpg)If you use **third-party senders**, confirm each one is included in the SPF record or configured with DKIM. _Services such as Google Workspace_\*,\*\* Microsoft 365, Cloudflare Email Routing, CRMs, and marketing platforms may require separate authentication steps.\* PowerSPF can help flatten or optimize complex SPF configurations when too many includes create [SPF lookup](https://autospf.com/blog/what-is-an-spf-lookup-and-why-it-matters/) failures. For ongoing monitoring, review email reporting data regularly. Aggregate reports show which systems are sending mail for your domain, whether they **pass email authentication**, and whether unauthorized sources are attempting [email spoofing](https://www.infosecurity-magazine.com/news/infosec2025-email-domains-spoofing/). Start with p=none, analyze reports, fix authentication gaps, and then move toward p=quarantine or p=reject when your domain security posture is ready. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 3m 5 key contributors to the development of the Sender Policy Framework Nov 12, 2024 ](/blog/5-key-contributors-to-sender-policy-framework-development/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How to Set Up DMARC in cPanel: Complete SPF, DKIM & DMARC Configuration Guide","description":"Learn how to set up DMARC in cPanel with SPF and DKIM, add a DMARC TXT record, prevent email spoofing, and improve email deliverability.","url":"https://autospf.com/blog/how-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide/","datePublished":"2026-07-20T00:00:00.000Z","dateModified":"2026-07-20T00:00:00.000Z","dateCreated":"2026-07-20T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-flatterning-5139-1784546925353.jpg","caption":"Configure DMARC in cPanel"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How to Set Up DMARC in cPanel: Complete SPF, DKIM & DMARC Configuration Guide","item":"https://autospf.com/blog/how-to-configure-dmarc-spf-dkim-in-cpanel-complete-guide/"}]} ```