SPF, DKIM and DMARC Guide for Business Email

Using email with your company domain is more than just opening a mailbox. Authentication records, sending services and the evaluations on the recipient's side all work together. Setting it up correctly makes your policy against spoofed messages clear; no record guarantees that every message will reach the inbox.

What's in this guide?

• First identify all sending sources
• What does SPF do?
• Why is the DKIM signature important?
• Move to a DMARC policy gradually
• Test DNS records and actual sending together

First identify all sending sources

Besides employees' mailboxes, your site's contact form, billing system and campaign tool may also send email using your domain. List which server or service each one uses. If an old system is forgotten, legitimate messages may also be affected once you tighten the security policy.

What does SPF do?

SPF uses DNS to define the sources that are expected to send email on behalf of the domain. Evaluate the record together with your existing configuration. Instead of creating multiple independent SPF records for the same domain, combine the authorized sources correctly. Do not copy an example record without verifying the value your service provider gives you.

Why is the DKIM signature important?

DKIM allows the sending system to sign a message with a domain. The recipient checks the signature using the public key published in DNS. The selector name and record value are obtained from the service being used. Multiple sending systems can work with different selectors; before deleting old keys, check whether they are still in use.

Move to a DMARC policy gradually

DMARC tells the recipient which policy to apply based on the results of authentication and domain alignment. Reports can help you understand your current sending flow. Moving directly to a reject policy before all legitimate sources have been verified can cause problems. Set up the report address so that you can actually monitor it, and advance the policy in a controlled way.

Test DNS records and actual sending together

The cPanel Email Deliverability screen helps you check the appropriate records. However, if DNS is managed elsewhere, the records must be edited at the authoritative DNS provider. Send test messages to different recipients and review the authentication results in the message headers. Message content, sender reputation and recipient policies also affect delivery.

Migration scenario

If company email runs on one service and the website's form submissions run on another server, both sources need to be taken into account. First find the SMTP service the form uses. Then bring the records recommended by the providers together in a single plan. After the change, test a message sent by a person and a notification generated by the site separately.

Practical checklist

• List all sending services.
• Edit the records on the authoritative DNS.
• Check SPF, DKIM and domain alignment.
• Test form and system notifications after changing the policy.

Frequently asked questions

Is DMARC necessary if you already have SPF and DKIM?

DMARC is a separate policy and reporting layer. Evaluate your setup's needs and your transition plan together with all of your sending sources.

If authentication passes, does that mean the message won't go to spam?

Successful authentication alone is not a guarantee of delivery. Content, reputation and the recipient's rules can also play a role.

Related guides

• DNS Records: What Do A, AAAA, CNAME, MX, TXT and NS Do?
• DNS Propagation and TTL: Why Don't Changes Appear for Everyone at the Same Time?
• Domain Name Transfer: A Migration Plan for Your Website and Email

Technical reference: cPanel Email Deliverability. Check the current official documentation for product and version details.

Business hosting options →