How to set up SPF, DKIM, and DMARC in Bluehost

Setting up SPF, DKIM, and DMARC in Bluehost is really one task done three times: you add a TXT record in Bluehost's DNS editor, and the only thing that changes each round is what goes in the host field and what value you paste. The three records themselves are not Bluehost-specific — SPF, DKIM, and DMARC work identically no matter who runs your DNS. What is specific to Bluehost is where the editor lives, what the host/name field expects for the root domain versus _dmarc versus a DKIM selector, and one wrinkle that trips up a lot of Bluehost customers: because Bluehost hosts so many WordPress sites, your domain often already has an SPF record you must merge into rather than duplicate. This guide walks through all three.

The short version#

All three are TXT records you add in the same place. What differs is the host name and where the value comes from:

• SPF — one TXT record at the root domain (host @), value starting v=spf1. Build it with the SPF record generator. Publish only one.
• DKIM — a TXT record at <selector>._domainkey, where both the selector and the long value are handed to you by your email provider. You never write this one yourself.
• DMARC — one TXT record at _dmarc, value starting v=DMARC1. Build it with the DMARC record generator and always start at p=none.

Where Bluehost keeps your DNS records#

Log in to your Bluehost account, open the Domains area, and select the domain you send mail from. Somewhere on that domain's management screen is a DNS section — Bluehost has called it the DNS Zone Editor in the past and simply "DNS" in the newer account manager. Open it and you'll see the zone's existing records: the A record for your site, the MX records for mail, and often a TXT record or two already there.

When you add a record, Bluehost shows a small form: a Type dropdown (pick TXT), a Host or Name field, the TXT Value, and a TTL. Leave TTL at its default — it only sets how long resolvers cache the record. The two fields that matter are the host and the value, and getting the host right is the whole game.

Bluehost appends your domain to whatever you put in the host field, so @ means the root domain itself, and _dmarc becomes _dmarc.yourdomain.com. Don't type the full domain into the host field or you'll end up with a doubled name like _dmarc.yourdomain.com.yourdomain.com.

Adding your SPF record in Bluehost#

SPF lists the servers allowed to send mail using your domain. This is the record where the Bluehost/WordPress wrinkle bites, so read this section before you touch anything.

First, check whether an SPF record already exists. In the DNS list, look for a TXT record on the root domain whose value begins with v=spf1. On Bluehost hosting there very often is one already — the platform frequently provisions an SPF record so the server's own mail (WordPress notifications, contact-form messages, cPanel mail) authenticates. It usually looks something like this:

v=spf1 +a +mx +ip4:XXX.XXX.XXX.XXX ~all

If that record exists and you now want to send through an email provider — Google Workspace, a marketing ESP, a transactional service — you must merge their include into the record you already have. Don't add a second SPF record: a domain may publish exactly one, and a second makes both invalid so SPF fails for everyone. This is the most common Bluehost SPF mistake.

A merged record keeps the existing mechanisms and adds the provider's include before the final all:

v=spf1 +a +mx +ip4:XXX.XXX.XXX.XXX include:_spf.google.com ~all

If there is no existing SPF record, you're starting clean: click Add Record, choose TXT, set the host to @, and paste a record listing just the sources you actually use. Let the SPF record generator assemble it — pick your providers and it outputs a single valid record with the includes in the right order, which is safer than hand-editing.

The ~all at the end is a soft-fail (accept but mark suspicious); -all is a hard-fail. Soft-fail is the safe default while you confirm every legitimate sender is listed.

Adding your DKIM record in Bluehost#

DKIM publishes a public key so receivers can verify a signature your provider adds to every message. The important thing to understand: the selector and the value both come from your email provider, not from Bluehost and not from you. You cannot invent a DKIM record — turn DKIM on in your ESP or mailbox provider's admin console, and it will show you exactly what to publish.

What your provider gives you is a host and a value that look like this:

Host:  s1._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQ…(long key)…

The selector is the part before ._domainkey — here s1, but it might be google, k1, dkim, selector1, or anything else your provider chose. In Bluehost, click Add Record, choose TXT, put the whole host string (s1._domainkey) into the Host/Name field, and paste the provider's value exactly as given into the TXT Value field. Copy the whole key — it's long, and a truncated key silently fails verification.

If you send through more than one service, each gives you its own selector, so two or three separate _domainkey records is normal — unlike SPF, DKIM isn't limited to one record per domain, because each lives at its own selector host.

Adding your DMARC record in Bluehost#

DMARC ties SPF and DKIM to the visible "From" address, tells receivers what to do with mail that fails, and sends you reports. It's a single TXT record at the _dmarc host.

Click Add Record, choose TXT, set the Host/Name field to _dmarc (Bluehost appends your domain to make _dmarc.yourdomain.com), and paste a starting value:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none is deliberate. It changes nothing about how your mail is handled — it just switches on the daily aggregate reports so you can watch which senders pass and which fail before you enforce anything. Publishing p=reject on day one, with DKIM freshly added and SPF possibly still missing a sender, is how people accidentally send their own mail to spam. The DMARC record generator will build a correct starting record and set the reporting address for you.

Once reports have been clean for a couple of weeks — every legitimate stream passing with SPF or DKIM aligned — you step the policy up to p=quarantine and eventually p=reject. The full sequence, including how alignment works and how to avoid the classic mistakes, is in the step-by-step DMARC rollout guide, and once reports start arriving, how to read DMARC reports explains what the XML is telling you.

Verify the records resolve#

DNS changes in Bluehost usually appear within minutes but can take a few hours to propagate, so don't panic if a lookup comes back empty at first. When you're ready, run all three through the SPF, DKIM, and DMARC checker. It tells you whether each record is found, whether it's syntactically valid, and — critically for SPF — whether you've accidentally published more than one record or blown the ten-DNS-lookup limit that too many includes can trigger.

A few things the checker will catch that are easy to miss on Bluehost:

• A leftover second SPF record from the platform default sitting alongside the one you added. Merge them into one.
• A DKIM key that got truncated on paste, or a selector that doesn't match the one your provider is actually signing with.
• A _dmarc host that Bluehost expanded oddly, leaving the record at the wrong name.

Why bother — the 2026 baseline#

This isn't housekeeping. Under the Google and Yahoo sender requirements, every sender needs at least SPF or DKIM, and bulk senders — more than 5,000 messages a day to Gmail — must have all three plus alignment and one-click unsubscribe. Getting all three right in Bluehost is what lets receivers trust that your mail is genuinely yours — but it's the entry ticket, not the whole show. Authentication proves identity; your sender reputation and list quality decide whether you land in the inbox.

Frequently asked questions#

Where do I add SPF, DKIM, and DMARC records in Bluehost?#

All three go in the DNS editor for your domain. Log in, open the Domains area, select the domain, and find its DNS or Zone Editor section, then use Add Record and choose TXT. Set the Host/Name to @ for SPF, to selector._domainkey for DKIM, and to _dmarc for DMARC, and paste each value. Bluehost has reorganized its control panel more than once, so the exact labels may differ or may have moved, but you're always looking for the per-domain DNS editor and a TXT record type.

Bluehost already has an SPF record — do I add another one?#

No. A domain may publish only one SPF record, and a second one invalidates both. Bluehost often provisions a default SPF record for the server's own mail, so when you add an email provider you edit that existing record and merge in the provider's include — for example adding include:_spf.google.com before the final ~all. Use the SPF record generator to assemble one correct record, then paste it over the old value rather than creating a new entry.

What do I put in the host field for DMARC in Bluehost?#

Enter _dmarc in the Host or Name field. Bluehost automatically appends your domain, producing _dmarc.yourdomain.com, which is where the record must live. Don't type the full domain yourself or you'll create a doubled name. Start the value at v=DMARC1; p=none; with an rua= reporting address so you can monitor before enforcing.

Where does my DKIM record value come from?#

From your email provider, never from Bluehost. Enable DKIM in your ESP or mailbox provider's admin console and it will display the exact selector (the part before ._domainkey) and the public-key value to publish. You copy that host and value into a TXT record in Bluehost exactly as given. If the provider offers a CNAME instead of an inline key, publish it as a CNAME — the point is that the signing values are always the provider's, not something you write.

Once SPF, DKIM, and DMARC are live in Bluehost and the checker shows all three passing, you've proven your identity — but a clean identity only reaches the inbox if the list behind it is clean too. Run your addresses through the free email checker to strip dead mailboxes and typos before they bounce, because authentication opens the door and list hygiene walks you through it.