What SPF include do I add for cPanel?

Usually none — cPanel isn't an include provider. Because your mail leaves from the hosting server's own MTA, cPanel authorizes the server's IP directly, e.g. v=spf1 +mx +a +ip4: ~all. The only time you'd add an include: is if your host routes outbound mail through a smarthost or spam filter, in which case Email Deliverability's suggested record shows that include for you.

The Repair / Install button does nothing — why?

Your domain's DNS isn't hosted on the cPanel server. cPanel can only publish to zones it's authoritative for; if your nameservers point to a registrar, Cloudflare, or Route 53 it's non-authoritative, so Install/Repair at most writes a local zone nobody queries and your live DNS never changes. Copy the suggested Name/Value from the Manage screen and add them as TXT records at your actual DNS host.

What DKIM selector does cPanel use?

default — so the record is always published at default._domainkey. cPanel generates the keypair itself and holds the private key on the server; you only publish the public key (v=DKIM1; k=rsa; p=…). If another service already uses the default selector on that domain, regenerate or resolve the conflict so the two don't collide.

Does cPanel set up DMARC too?

Newer versions suggest a DMARC record (often a bare v=DMARC1; p=none;); older ones don't. Either way, add or edit _dmarc yourself to include an rua address (v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com) so you actually receive reports, and keep just one _dmarc record per domain.

My WordPress / contact-form email goes to spam even though webmail is fine — why?

Scripts using PHP mail() or wp_mail send through the same Exim server, so SPF and the default._domainkey DKIM key cover them — but only if the script sends with a From/envelope on your domain. Many plugins default to wordpress@server-hostname or some mismatched address, which breaks DMARC alignment even though Exim signed the message. Point the plugin's From at a real mailbox on your domain (or use an SMTP plugin that authenticates to a domain mailbox) so the visible From, the DKIM d=, and the envelope all align to yourdomain.com.

SPF setup guide

SPF, DKIM & DMARC for cPanel / WHM shared hosting.

cPanel/WHM shared hosting is unlike an ESP: there's no \"authenticate your domain\" wizard and no shared SPF include to paste. Your mail is sent by the hosting server's own mail server (Exim), so authentication is built from the server's outbound IP address, not from a hosted provider's records. Modern cPanel ships an Email Deliverability interface (under the Email section) that auto-generates all three records for you — an SPF record built from the server IP, a DKIM key on the default selector, and, on newer versions, a starter DMARC — and it will either install them automatically (if your host also runs your DNS) or hand you the exact Name/Value pairs to paste at whatever DNS host you actually use.

Dedicated-IP authentication

Your DNSAdd the CNAME / TXT records

cPanel / WHM shared hostingSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate cPanel / WHM shared hosting?

Shared-hosting mail is some of the most likely to land in spam, and cPanel makes it straightforward to fix. Since February 2024 Gmail and Yahoo have required every sender to pass SPF or DKIM — and every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment — and Microsoft began enforcing the same on high-volume consumer mail in 2025. On cPanel, the Exim server sends everything as your domain: your IMAP mailboxes, webmail, and every script on the account (WordPress wp_mail, contact forms, WooCommerce receipts), all from the server's IP. Until you publish SPF and DKIM, none of that mail is provably yours — receivers can't tie it to your domain, DMARC can't pass, and because you share the server's IP your reputation is pooled with every other tenant on the box. Authenticating aligns SPF (your server's IP is authorized in your record) and DKIM (Exim signs as d=yourdomain.com) to your own domain, so DMARC passes and the sending reputation you build accrues to you instead of the shared pool.

The SPF reality for cPanel / WHM shared hosting

cPanel is a \"dedicated-IP\"-style setup, not an include provider: there is NO universal include:cpanel.net to add — cPanel is server software, not a mail service. Because your mail leaves from the hosting server's own MTA (Exim), SPF has to authorize that server's outbound IP directly. cPanel's Email Deliverability builds the record for you and it looks like v=spf1 +mx +a +ip4:<your server's IPv4> ~all (an +ip6: mechanism is appended when the server has IPv6). The +ip4: piece is what actually matters — it's your server's real sending IP, so the value is unique to your host/server and stops matching if you migrate to a new server, switch to a dedicated IP, or the host renumbers you. The +mx authorizes whatever your MX hosts resolve to and +a authorizes the domain's own A record; cPanel adds both as a convenience, and each costs one of your 10 SPF DNS lookups. Two host-specific wrinkles: (1) some cPanel hosts don't send directly — they route outbound mail through a smarthost or an outbound spam filter (SpamExperts, or a Newfold/EIG gateway), in which case the correct SPF is that provider's own include (e.g. include:websitewelcome.com or a SpamExperts a: host) rather than your server IP, and cPanel's suggested record reflects it; (2) if you also send from any other service (Google Workspace mailboxes, a marketing ESP), you must merge its mechanism into this one v=spf1 record — never publish a second SPF TXT, which is itself a PermError.

Two ways to set it up

Recommended

cPanel runs your DNS — auto-install

Your domain uses the host's nameservers, so cPanel is authoritative for the zone
Email Deliverability's Repair / "Install the Suggested Record" writes SPF, DKIM (and DMARC) in one click
cPanel keeps the SPF IP in sync if the host moves or renumbers your server
Nothing to copy — just refresh until the status flips to Valid

Legacy

DNS lives elsewhere — copy manually

Your domain points at a registrar, Cloudflare, or Route 53 for DNS, so cPanel is non-authoritative
Install/Repair only writes a local zone nobody queries and warns it can't manage the real zone — expected, not a bug
Click Manage, copy each suggested Name + Value, and add them as TXT records at your real DNS host
You own keeping the +ip4: SPF value current if you ever migrate servers

Step by step

In cPanel

1
Open Email Deliverability
Log into cPanel and, under the Email section, open Email Deliverability. You'll see every domain on the account with a status — Valid, or "Problems Exist" with a red flag. If the tile is missing entirely, your host disabled the feature; ask them to enable it in WHM » Home » Packages » Feature Manager.
2
Click Manage on your sending domain
Next to the domain you send from, click Manage. cPanel shows separate panels for DKIM, SPF, and (on newer versions) DMARC, each with the exact record it recommends and whether the current DNS already matches.
3
Decide who controls the DNS
If the domain uses your host's nameservers, cPanel is authoritative and an "Install the Suggested Record" / Repair button applies the fix directly — click it and skip to Verify. If your nameservers point to a registrar, Cloudflare, or Route 53, cPanel is non-authoritative: Install/Repair at most writes a local zone that nobody queries, so you copy the records to your real DNS host instead (next steps). This split is the single biggest source of confusion with cPanel authentication.

In your DNS

4
Publish (or merge) the SPF TXT
Copy the suggested SPF value — v=spf1 +mx +a +ip4:<server IP> ~all — and add it as a TXT record on the root (host @ or blank). If an SPF record already exists for the domain, merge the +ip4:/include into that single record rather than adding a second SPF TXT. If your host routes mail through a smarthost/filter, use whatever include cPanel suggests instead of the raw IP.
5
Publish the DKIM TXT
cPanel generates the key on the default selector. Add a TXT record with host default._domainkey and the value v=DKIM1; k=rsa; p=<long public key>. Current cPanel keys are 2048-bit, which is longer than a single 255-character TXT string, so paste it exactly as cPanel splits it into quoted chunks.
6
Publish the DMARC TXT
Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Newer cPanel suggests a bare v=DMARC1; p=none; — always add an rua address so you actually receive reports. Keep exactly one _dmarc record for the whole domain.
7
Fix host doubling and the Cloudflare proxy
If your registrar auto-appends the domain, enter just the label (default._domainkey, not default._domainkey.yourdomain.com) to avoid doubling. TXT records aren't proxied, so on Cloudflare they stay "DNS only" (grey cloud) automatically — the orange-cloud proxy only applies to A/AAAA/CNAME records.

Verify

8
Re-check in cPanel and read the headers
Back in Email Deliverability, refresh — the status should flip to Valid once DNS propagates (usually minutes, up to a few hours). Then send a real test to a Gmail address, open ⋮ → Show original, and confirm SPF: PASS (your server's IP), DKIM: PASS with signed-by: yourdomain.com and selector default, and DMARC: PASS.
9
Check reverse DNS (PTR)
cPanel can't set your PTR — the IP owner (your host or data center) does. Look up the server's sending IP; the PTR should resolve to a hostname that forward-resolves back to the same IP. On shared hosting it usually points to the host's generic mail hostname, which is fine as long as it's consistent; on a dedicated IP, ask the host to set a PTR matching your mail hostname.

Records to add

cPanel / WHM shared hosting generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	@	v=spf1 +mx +a +ip4:192.0.2.10 ~allRoot SPF — the +ip4 is YOUR server's outbound IP (unique per host/server); +mx and +a each cost 1 DNS lookup. Keep one SPF record and merge other senders into it. If your host uses a smarthost/filter, cPanel instead suggests an include (e.g. include:websitewelcome.com).
TXT	default._domainkey	v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…(public key from Email Deliverability)Illustrative — cPanel generates the keypair on the 'default' selector and holds the private key on the server. 2048-bit keys are published as split quoted strings; copy the exact value cPanel shows.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comOne per domain. cPanel may suggest a bare v=DMARC1; p=none; — add an rua address so you get reports. Start at p=none, then tighten to quarantine/reject.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what cPanel / WHM shared hosting's setup costs against that budget.

SPF 10-lookup budget2 used · 8 free

cPanel / WHM shared hosting adds 2 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

cPanel generates the DKIM keypair for you — you never paste a key from a provider. In Email Deliverability → Manage, the DKIM panel holds the private key on the server (Exim signs your outbound mail with it) and shows the matching public key as a TXT record on the default selector: host default._domainkey, value v=DKIM1; k=rsa; p=<public key>. If cPanel is authoritative for your zone, \"Install the Suggested Record\" publishes it; otherwise you copy the Name and Value to your external DNS host. A few cPanel specifics: the selector is literally 'default', so the record is always default._domainkey — if some other service already claimed that selector on the domain you'll get a conflict, so regenerate or use the other tool's selector. Older cPanel builds generated 1024-bit keys; current versions default to 2048-bit, which exceeds the 255-character single-string TXT limit and must be published as the split, quoted chunks cPanel shows — a mangled concatenation is the usual reason a \"correct\" key fails validation. If you migrate hosts, the private key stays on the old server, so you regenerate DKIM and republish default._domainkey on the new box. Because DKIM signs as d=yourdomain.com, it's the mechanism that keeps DMARC passing even when a message is forwarded and SPF breaks.

DMARC

DMARC is a separate policy record. Newer cPanel Email Deliverability suggests one (often a bare v=DMARC1; p=none;), but older versions leave it to you — add it in cPanel's Zone Editor or at your external DNS host as a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com — always add an rua address even if cPanel's suggestion omits it, or you get no reports to learn from. p=none is monitor-only, so nothing changes about delivery while you confirm the server's mail passes SPF and DKIM aligned to your domain. Watch the aggregate (rua) reports for a week or two — pay special attention to any scripts on the server (WordPress, contact forms, WooCommerce) that might send from a mismatched envelope — then tighten to p=quarantine and eventually p=reject once alignment is consistent. Keep exactly one _dmarc record for the whole domain no matter how many mailboxes or apps send from the server; subdomains inherit the parent policy unless you override them.

Check it actually worked

Don't trust cPanel's \"Valid\" badge alone — it only checks that your DNS matches what it suggested, not that mail actually authenticates. Send a real message from a mailbox on the domain (or trigger a script that sends, like a test contact-form submission) to a Gmail address, open it, and choose ⋮ → Show original: you want SPF: PASS showing your server's IP, DKIM: PASS with signed-by: yourdomain.com and selector default, and DMARC: PASS. Then check reverse DNS on the server's sending IP — on shared hosting a missing or mismatched PTR is a common silent spam trigger; use a reverse DNS lookup and make sure it forward-confirms. Run the domain through Qualisend's domain health check to confirm SPF, the default._domainkey DKIM, and _dmarc all resolve and that your SPF stays under the 10-lookup limit (cPanel's +mx +a already spend two). Once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer to confirm the server shows up as an aligned, passing source.

Domain health check DMARC report analyzer

Common gotchas

Coverage
Repair only writes DNS that cPanel controls. If your nameservers point to a registrar, Cloudflare, or Route 53, the cPanel server is non-authoritative — clicking Install/Repair at most writes a local zone nobody queries, so your live DNS is unchanged. That's expected: copy the Name/Value from the Manage screen and add the records at your real DNS host.
Coverage
It's your server's IP, not a shared include. cPanel builds SPF from the box's outbound IP (+ip4:), so the value is unique to your server. Migrate hosts, move to a dedicated IP, or let the host renumber you and the old ip4: stops matching — update the record. Never copy another site's cPanel SPF verbatim.
Coverage
Shared IP means shared reputation. On shared hosting you send from an IP shared with many other tenants; if a neighbor spams and the IP gets blacklisted, your mail suffers too, even with perfect SPF/DKIM. Monitor the sending IP and consider a dedicated IP for real volume.
Breaks auth
cPanel's +mx +a already spend two of your 10 SPF lookups before you add anything else. Stack Google Workspace plus a marketing ESP on top and you can hit the RFC 7208 PermError limit. If you don't rely on mx/a for sending, trimming to v=spf1 +ip4:<server IP> ~all reclaims both lookups.
Breaks auth
Don't end up with two SPF records. If cPanel wrote an SPF into the local zone but your live DNS is external, you can accidentally publish a second SPF TXT — two SPF records is itself a PermError. Keep exactly one and merge everything into it.
Coverage
PTR / reverse DNS isn't in cPanel. The IP owner (your host or data center) controls it. A missing or generic PTR that doesn't forward-confirm quietly hurts deliverability at Gmail and Outlook — request a matching PTR from your host, especially on a dedicated IP.
DNS setup
2048-bit DKIM keys are split across quoted strings. cPanel's current default key is too long for a single 255-character TXT string; publish it exactly as the panel splits it. A dropped or mis-joined chunk is the usual cause of a "published but invalid" DKIM.
Coverage
Some hosts route mail through a smarthost/filter. Newfold/EIG brands and hosts using an outbound spam filter (SpamExperts) send through a gateway, so the correct SPF is their include (e.g. include:websitewelcome.com), not your server IP — use whatever Email Deliverability suggests rather than assuming +ip4.

Build your SPF record

cPanel / WHM shared hosting doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Sending sources

Search for each platform you send email through and tick it.

Search for your email platform above, or .

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record0/10 DNS lookups

v=spf1 ~all

No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list