Published 20 October 2026
When a business email lands in spam or fails authentication, check the domain’s DNS records before changing them. cPanel’s Email Deliverability screen can report problems with SPF and DKIM and offer suggested repairs; DMARC depends on valid SPF and DKIM records. But if another provider manages your DNS or sends some of your mail, copying a suggested value without checking can break legitimate messages.
This guide is for site owners, online shops, agencies and resellers who use a domain-based email address. It explains what the three records do, how to inspect them in cPanel, and what to verify before making changes. Authentication helps receiving systems assess whether mail is authorised; it cannot guarantee inbox placement.
What SPF, DKIM and DMARC each check
SPF is a DNS record that identifies servers permitted to send mail for a domain. DKIM lets a receiving system check a cryptographic signature on a message against a public key published in DNS. DMARC tells receivers how to handle mail that fails its checks and evaluates whether authenticated sending aligns with the visible From domain.
These records describe different parts of the sending setup. A business might send website notifications through its hosting account, newsletters through an email platform, and staff mail through a separate provider. Each legitimate sender needs to be considered before the DNS policy is tightened. Google’s Postmaster Tools documentation separately reports SPF, DKIM and DMARC-related compliance signals, while cPanel explains the records and their dependencies in its Email Deliverability guide.
- SPF: Which sending services are authorised for the domain?
- DKIM: Is there a verifiable signature associated with the sending domain?
- DMARC: What should receivers do with failures, and does authentication align with the From domain?
Before you click Repair in cPanel
Open cPanel → Email → Email Deliverability and select the relevant domain. The interface lists the status of mail-related DNS records and may show a Repair option. cPanel notes that the interface must be enabled by the hosting provider, and that repair is unavailable when the system does not control the domain’s DNS records.
First establish where the domain’s authoritative DNS is managed. It could be your hosting account, a registrar, or a separate DNS service. A record changed in cPanel’s local zone may not be published to the internet if another provider’s nameservers are authoritative. In that case, copy the appropriate suggested record only after checking it, then update the active DNS provider’s zone.
Important: Do not replace an existing SPF record with a suggested value until you have identified every service that sends mail using your domain. Removing a legitimate sender can cause its messages to fail SPF checks.
A safe authentication check
- List your senders. Record the systems used for employee mail, website forms, order confirmations, support tickets and newsletters. Ask each provider for its current DNS instructions; do not guess server names or IP addresses.
- Confirm active DNS control. Check which nameservers the domain uses and identify the service where its live DNS zone is edited. Make a copy of current TXT records before changing them.
- Inspect SPF and DKIM. In Email Deliverability, review the status and suggested values. Check that the SPF record includes all approved sending systems. For DKIM, verify that the selector and public-key record supplied by each sender are present in the authoritative zone.
- Review DMARC after SPF and DKIM. Start by understanding the existing policy and where reports, if any, are sent. A stricter policy can affect legitimate mail that has not been brought into alignment, so confirm every sender before changing enforcement.
- Change one thing at a time. Save the old value, make the DNS change at the authoritative provider, and allow for DNS caching. Avoid publishing multiple SPF TXT records for the same domain; check the domain’s existing configuration before editing.
- Test real messages. Send a message from each important service to a mailbox you can inspect. Review the received message’s authentication results, then check cPanel’s status again. If an order email or form notification fails, investigate the sending service and DNS together.
Common causes of a misleading warning
- Third-party DNS: cPanel can show local recommendations, but the public record must be updated where authoritative DNS is hosted.
- Multiple senders: A website, newsletter tool and staff mail provider may all need authorisation or DKIM configuration.
- Mail moved to another provider: The website may remain on cPanel even though MX records and mail authentication are now managed elsewhere. Follow the email provider’s instructions, not assumptions based on website hosting.
- DMARC added too early: A restrictive policy can affect legitimate mail not yet authenticated or aligned. First identify all sources and test their messages.
cPanel also notes that DMARC requires valid SPF and DKIM, and its interface may not control DNS records for domains managed elsewhere. Treat a green status as a useful check, not proof that every application’s messages reach inboxes.
When to ask for help
Contact the administrator of the authoritative DNS zone when you cannot identify where records are published. Ask your mail provider for its exact SPF and DKIM values if a sender is missing. For a WordPress shop, test practical messages such as order confirmations and password resets after a change, not only a message sent from webmail.
HostCupid Web Solutions Private Limited is a Chennai-based company providing hosting, website development and migration assistance. For a customer moving a site while retaining email with a separate provider, the key operational question is which service currently controls DNS and mail—not simply which server hosts the website. Confirming that before a migration or DNS edit can help avoid interrupting customer enquiries, receipts and account notifications.
Keep a record of the final setup
Save the DNS provider, approved sending services, current SPF and DMARC values, and the DKIM selectors each provider requires. Revisit this inventory when you change email platforms, hosting, website forms or newsletter tools. That small record makes the next warning easier to diagnose and reduces the risk of removing a sender that the business still depends on.
Sources
