SPF, DKIM & DMARC for Bluehost.
Bluehost is a Newfold Digital hosting brand, so "authenticating your domain" here almost always means the email that comes with your hosting plan — the cPanel/webmail mailboxes and any mail your site's PHP scripts and cron jobs send — rather than a separate email product. Bluehost pushes that mail through a shared outbound pool that is proxied to websitewelcome.com (the same Newfold/HostGator infrastructure that powers several sister brands), which is why the SPF include you publish is include:websitewelcome.com. Bluehost can auto-generate an SPF record and a DKIM key for you through cPanel's Email Deliverability tool, but DMARC is always left for you to add by hand. This guide covers both the classic cPanel path and the newer Bluehost portal, the exact TXT records, and the one thing that trips up almost everyone: how many DNS lookups that websitewelcome.com include quietly consumes.
Why authenticate Bluehost?
On a hosting account it is tempting to treat SPF/DKIM as optional housekeeping, but since February 2024 Gmail and Yahoo require every sender to pass SPF or DKIM, and every bulk sender (roughly 5,000+ messages a day) to also publish a DMARC policy with alignment; Microsoft began enforcing the same rules for high-volume senders in 2025. Bluehost helps with part of this — its Email Deliverability tool can publish an SPF record and generate a DKIM key — but it never creates a DMARC record for you, so an "authenticated" Bluehost domain is frequently still missing the piece receivers now look for. There is a second, Bluehost-specific reason to get this right: hosting customers very often point their MX at Google Workspace or Microsoft 365 for real mailboxes while an old include:websitewelcome.com still sits in their SPF. That mismatch means your SPF authorizes servers you no longer send from, wastes a big chunk of your lookup budget, and does nothing for the mail that actually leaves your domain. Doing SPF + DKIM + DMARC deliberately — matched to how you truly send — is what keeps password resets, contact-form mail, and newsletters out of the spam folder and stops your domain being spoofed.
The SPF reality for Bluehost
websitewelcome.com is a genuine shared SPF include — it is the Newfold/HostGator outbound proxy host that Bluehost's shared and Cloud plans relay through, and Bluehost's own documentation publishes v=spf1 a mx include:websitewelcome.com ~all as the stock record for both Portal and Bluerock accounts. So yes, if you send through Bluehost's mail servers, this is a real include you add to the single SPF TXT record on your root domain. Three things make it more nuanced than a typical include, though. First, it is heavy: include:websitewelcome.com is deeply nested and resolves (verified live) to about eight DNS lookups — it chains eig.spf.a.cloudfilter.net and spf.websitewelcome.com, which in turn pulls _spf.nfco-mailout.com and its two netblocks, plus _spf.google.com and spf.protection.outlook.com. Add the a and mx mechanisms Bluehost bundles into the default record and you are already at the RFC 7208 ceiling of ten lookups with no room for any other sender. The leaner include:spf.websitewelcome.com resolves to only about four lookups, but it covers just the core HostGator/Newfold shared netblocks and drops the Google and Microsoft ranges the full include bundles in — so only swap to it if your Bluehost mail sends purely from the shared cPanel pool, and if you don't actually send through Bluehost's servers at all, drop the include entirely. Second, Bluehost automatically drops a default v=spf1 record into your zone for every domain, so you must edit that one record rather than publish a second one — two SPF records is an automatic PermError. Third, the include only describes the shared pool: VPS and Dedicated plans send from your own dedicated IP, so you add ip4:<your dedicated IP>, and the newer Bluehost Cloud / OX-powered professional email uses a completely different include, include:spf.cloudus.oxcs.net. Bottom line: publish include:websitewelcome.com only for mail that genuinely leaves Bluehost's shared servers, keep it to a single SPF line, and mind the lookup count.
Two ways to set it up
Mailboxes on your Bluehost hosting — add the include
- Applies when your MX and mailboxes live on Bluehost (cPanel/webmail) or your site's PHP mail()/cron sends mail
- Outbound is proxied to the shared pool, so include:websitewelcome.com authorizes it — Bluehost's own stock record for Portal and Bluerock accounts
- Enable the default-selector DKIM key via cPanel Email Deliverability so DMARC can align on DKIM
- VPS/Dedicated: add ip4:<your dedicated IP> because those plans don't use the shared pool
MX pointed at Google Workspace / Microsoft 365
- Bluehost is not the one sending that mail, so include:websitewelcome.com authorizes servers you don't use
- It adds nothing for your real mail and burns roughly eight of your ten SPF lookups
- Use include:_spf.google.com or include:spf.protection.outlook.com instead, matched to your provider
- Only keep a Bluehost include if scripts/cron on the host still send mail directly
Step by step
- 1
Confirm how your domain actually sends
Check where your mailboxes live and what your MX points to. If mail lands in Bluehost cPanel/webmail (or your site's scripts send it), the websitewelcome.com include applies. If your MX is Google Workspace or Microsoft 365, you'll authenticate with their records instead and the Bluehost include is unnecessary.
- 2
Open Email Deliverability (cPanel accounts)
On cPanel-based plans, go to cPanel > Email > Email Deliverability, find the domain, and click Manage (or Repair). cPanel generates a suggested SPF record and a DKIM key; when Bluehost is authoritative for the domain it publishes them into your zone automatically, otherwise it shows the exact TXT Name/Value pairs to paste at your DNS host.
- 3
Or open the DNS editor (new Bluehost portal)
On newer portal accounts there's no cPanel: go to Domains, select the domain, open the DNS tab, and scroll to Manage Advanced DNS Records (also reachable via Advanced Tools > Advanced DNS Records). This is where you add the SPF, DKIM, and DMARC TXT records by hand.
- 4
Edit the auto-added SPF — don't duplicate it
Bluehost drops a default v=spf1 record into your zone for every domain. Edit that existing record rather than adding a second one; two SPF records on the same name is an automatic PermError that fails SPF outright.
- 5
Publish the SPF record
Set a TXT record at host @ with v=spf1 a mx include:websitewelcome.com ~all. If your Bluehost mail sends purely from the shared pool, the leaner v=spf1 a mx include:spf.websitewelcome.com ~all costs far fewer lookups (but omits the bundled Google/Microsoft ranges). On VPS/Dedicated add your server's ip4:<dedicated IP>. In the portal use + ADD RECORD > Single record, Type TXT, Refers to @, and a low TTL (1-4 hours).
- 6
Add the DKIM record
cPanel Email Deliverability generates a 2048-bit key with the default selector, published as a TXT record at default._domainkey with value v=DKIM1; k=rsa; p=<public key>. If Bluehost hosts your DNS it's added for you; on external DNS, copy it exactly. If you actually send via a third party (Google, M365, SendGrid, a newsletter tool), publish THAT provider's DKIM instead of Bluehost's.
- 7
Publish a DMARC policy
Add a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Bluehost never creates this for you. Start at p=none (monitor-only) so nothing is affected while you confirm alignment, then tighten to quarantine and reject.
- 8
Re-check Email Deliverability and send a test
In cPanel, the Email Deliverability tool should show green checks for SPF and DKIM (its Repair view lists anything still wrong). Then send a real message, open it in Gmail, and use Show original to confirm SPF: PASS, DKIM: PASS, and DMARC: PASS all aligned to your domain. Finish with Qualisend's domain health check to confirm the SPF stays under ten lookups.
Records to add
Bluehost generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 a mx include:websitewelcome.com ~allRoot SPF for Bluehost-hosted mail — keep exactly one SPF record and merge other senders into this line. This include resolves to about 8 DNS lookups; the leaner include:spf.websitewelcome.com (~4 lookups) works only if your mail sends purely from the shared cPanel pool, since it drops the bundled Google/Microsoft ranges. On VPS/Dedicated add ip4:<your dedicated IP>. |
| TXT | default._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...(2048-bit public key from cPanel Email Deliverability)Illustrative — the actual key is generated per domain under cPanel > Email > Email Deliverability (default selector). For third-party senders, publish their DKIM record instead. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comOne DMARC record per domain. Bluehost doesn't add this — start at p=none, then tighten to quarantine/reject. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Bluehost's setup costs against that budget.
Bluehost adds 8 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
Bluehost's DKIM depends on which interface your account uses, but the standard path is cPanel's Email Deliverability tool: it generates a 2048-bit key with the selector default and publishes it as a TXT record at default._domainkey.yourdomain.com whose value is v=DKIM1; k=rsa; p=<public key>. Bluehost holds the matching private key and signs your outbound mail with it. When the domain uses Bluehost's own nameservers (Bluehost is authoritative), the tool writes and repairs this record for you automatically; if your DNS is at Cloudflare, a registrar, or elsewhere, Email Deliverability instead displays the exact Name/Value to paste, and you add it manually. On newer Bluehost portal accounts without cPanel, you add the same TXT under Domains > DNS > Manage Advanced DNS Records (Advanced Tools > Advanced DNS Records). Two Bluehost-specific cautions: first, DKIM only proves the mail that Bluehost's servers actually send — if you send through Google Workspace, Microsoft 365, SendGrid, or a newsletter platform, that mail must carry THAT provider's DKIM selector (google._domainkey, selector1/2._domainkey, s1/s2._domainkey, etc.), not Bluehost's default selector. Second, Bluehost Cloud / OX-powered professional email is a different mail product with its own DKIM keys and the include:spf.cloudus.oxcs.net SPF — don't mix its records with the classic shared-hosting ones.
DMARC
DMARC is the one record Bluehost never creates for you — even after Email Deliverability publishes SPF and DKIM, there is no DMARC policy until you add it. Publish a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but asks receivers to email you aggregate reports so you can confirm that your Bluehost mail (and anything else sending as your domain) is passing SPF and DKIM aligned to your organizational domain. Watch those reports for a week or two, make sure every legitimate source authenticates, then tighten to p=quarantine and eventually p=reject — the policy that actually stops spoofing. Keep exactly one _dmarc record for the whole domain no matter how many senders you use, and add it in the same place as your SPF/DKIM (cPanel is not where DMARC lives — it's a plain TXT record in your zone, via Manage Advanced DNS Records on the portal or your external DNS host).
Check it actually worked
Don't stop at cPanel's green checkmarks — confirm on a real message. In cPanel, Email Deliverability should show SPF and DKIM as valid for the domain, and its Repair view flags anything still broken. Then send a message from a Bluehost mailbox to a Gmail account, open it, and choose Show original: you want SPF: PASS, DKIM: PASS (signed-by your domain, selector default), and DMARC: PASS, all aligned to yourdomain.com rather than websitewelcome.com. You can spot-check the raw records with dig TXT yourdomain.com, dig TXT default._domainkey.yourdomain.com, and dig TXT _dmarc.yourdomain.com. Critically, because the websitewelcome.com include is so deeply nested, verify your total SPF lookup count stays at or under ten — run the domain through Qualisend's domain health check and the SPF/DKIM/DMARC checker, which resolve the whole include chain and flag a PermError before mailbox providers do. Once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer to confirm Bluehost shows up as an aligned, passing source.
Common gotchas
- DNS setup
The websitewelcome.com include is a lookup hog. include:websitewelcome.com resolves (verified live) to about eight nested DNS lookups — it chains eig.spf.a.cloudfilter.net and spf.websitewelcome.com, which pull _spf.nfco-mailout.com and its two netblocks, plus _spf.google.com and spf.protection.outlook.com. Add the a and mx that Bluehost's stock record bundles and you hit the RFC 7208 limit of ten with no room for any other sender. Use the leaner include:spf.websitewelcome.com (~4 lookups, but it omits the bundled Google/Microsoft ranges) or drop the include if you don't send through Bluehost.
- Breaks auth
Two SPF records = PermError. Bluehost auto-adds a default v=spf1 record for every domain, so if you paste your own you now have two — which fails SPF outright. Edit the existing record; never publish a second SPF TXT. The same rule applies to DMARC: exactly one _dmarc record.
- Breaks auth
If your MX is Google Workspace or Microsoft 365, the Bluehost include is authorizing mail you don't send. It does nothing for your real mail and just wastes lookups — replace it with include:_spf.google.com or include:spf.protection.outlook.com.
- Coverage
VPS and Dedicated plans send from your dedicated IP, not the shared pool. include:websitewelcome.com won't cover that mail — add ip4:<your dedicated IP> to the SPF record.
- Coverage
Bluehost Cloud / OX-powered professional email is a different product. It uses include:spf.cloudus.oxcs.net and its own DKIM keys, not websitewelcome.com — confirm which mail product the account is actually on before copying records.
- DNS setup
cPanel only auto-publishes when Bluehost is authoritative. If your DNS is at Cloudflare or your registrar, Email Deliverability just shows the SPF/DKIM values — you have to paste them at that DNS host yourself, or the tool will keep reporting them as missing.
- DNS setup
Host-field doubling: the portal's Refers to field appends your domain, so enter @ for the root SPF and just default._domainkey (the label) for DKIM — not the full FQDN — or you'll create default._domainkey.yourdomain.com.yourdomain.com.
- Coverage
Bluehost sets up SPF and DKIM but never DMARC. An account that 'passed' the Email Deliverability check can still have no DMARC policy at all, which is exactly what Gmail/Yahoo bulk-sender rules now require — you must add the _dmarc record yourself.
Build your SPF record
Bluehost is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listBluehost SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.