SPF, DKIM & DMARC for Namecheap Private Email.
Namecheap Private Email is Namecheap's hosted mailbox product (powered by Open-Xchange App Suite), so authenticating it isn't about pasting one magic line — it's four moving parts working together: two MX records so the mailbox can receive, an SPF TXT that authorizes Private Email's outbound servers, a DKIM TXT you generate in the Private Email panel, and a DMARC policy on your root domain. The wrinkle that makes this provider specific: Private Email sends bounces from its own return-path domain, so SPF passes but never aligns to your From address — DKIM is the record that actually carries your DMARC pass. If your domain runs on Namecheap's own BasicDNS nameservers, the MX and SPF records are added for you automatically and DKIM is one click; on any other DNS host you publish all four by hand.
Why authenticate Namecheap Private Email?
Authenticating Private Email is what keeps your mail out of the spam folder. Since February 2024, Gmail and Yahoo have required every sender to pass SPF or DKIM, and every bulk sender (roughly 5,000+ messages a day) to also publish a DMARC policy with alignment; Microsoft began rejecting non-compliant mail in 2025. Private Email routes your mail through shared Namecheap/Jellyfish infrastructure, so until you publish SPF, DKIM, and a DMARC record, your From address isn't cryptographically yours, DMARC can't pass, and your domain's reputation is pooled with every other unauthenticated sender on that platform. Because Private Email's return-path lives on its own domain, this provider is a case where you cannot lean on SPF alone — DKIM alignment is doing the real work, so setting all three up correctly (and confirming DKIM actually passes aligned) is the difference between reliable inboxing and silent spam-foldering.
The SPF reality for Namecheap Private Email
Private Email is a genuine shared-include provider: you add one mechanism, include:spf.privateemail.com, to the single SPF TXT record on your root domain, giving v=spf1 include:spf.privateemail.com ~all. Every Private Email customer uses that same include, and it authorizes Private Email's sending IPs so SPF evaluates to pass. Two things make it worth understanding rather than copy-pasting. First, it is not a flat record — a live lookup of spf.privateemail.com shows it nests three further includes (ips1.privateemail.com, fbrelay.privateemail.com, and spf-pe.jellyfish.systems), so that single include:spf.privateemail.com actually consumes FOUR of your 10 permitted SPF DNS lookups (RFC 7208), not one. Stack Google Workspace, SendGrid, or Mailchimp on top and you can hit the PermError ceiling faster than you'd expect. Second, and more important: Private Email uses its own domain as the envelope Return-Path, so while SPF passes, it does NOT align to your From domain — which means SPF alone will never satisfy DMARC here. That is why publishing SPF is necessary but not sufficient: DKIM, which signs with your own domain, is the mechanism that delivers the DMARC pass. So do add the include (it's the standard, recommended root-SPF path and helps deliverability), keep exactly one SPF TXT record, prefer the ~all softfail, but treat DKIM as mandatory rather than optional.
Step by step
- 1
Open your Private Email subscription
Sign in at namecheap.com and pick Private Email from the left sidebar (or Apps → Private Email). Click Manage next to the subscription for your domain. This panel is where DKIM lives — the MX, SPF, and DMARC records are published separately wherever your domain's DNS is hosted.
- 2
Generate your DKIM key
Open the DKIM section of the subscription and click Generate. Namecheap creates an RSA key and shows the TXT host and a long value starting v=DKIM1; k=rsa; p=…. The host is privateemail._domainkey on subscriptions purchased from June 2, 2026 onward, or default._domainkey on older ones — copy exactly what your panel shows. On newer subscriptions DKIM is available immediately on ordering; on legacy plans you may need to create a mailbox first.
- 3
Find where your DNS is hosted
Records go wherever your domain's nameservers point. If the domain uses Namecheap BasicDNS, go to Domain List → Manage → Advanced DNS. If you moved DNS to Cloudflare, GoDaddy, a web host's cPanel, or Namecheap PremiumDNS, add the records there instead — Namecheap can only auto-publish on its own BasicDNS.
- 4
Add the two MX records
On the root (Host @) create two MX records: mx1.privateemail.com and mx2.privateemail.com, both Priority 10. These let the mailbox receive mail. On BasicDNS, choosing Advanced DNS → Mail Settings → Private Email adds these MX records (and the SPF record) for you automatically.
- 5
Publish or merge the SPF record
Add a TXT record on the root (Host @): v=spf1 include:spf.privateemail.com ~all. If a v=spf1 record already exists (from old hosting or another sender), do NOT add a second one — merge include:spf.privateemail.com into the existing record, since two SPF records is itself a PermError. Keep the ~all softfail unless you're certain every sender is listed.
- 6
Publish the DKIM TXT record
Add a TXT record with Host = the selector from step 2 (privateemail._domainkey or default._domainkey) and Value = the full v=DKIM1; k=rsa; p=… string. On BasicDNS this is auto-added when you generate the key; on any other DNS host you paste it in by hand. This is the record that actually carries your DMARC pass, so don't skip it.
- 7
Add a DMARC policy
Create a TXT record at Host _dmarc: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none to monitor without affecting delivery, watch the aggregate (rua) reports, then raise to p=quarantine and eventually p=reject once you've confirmed DKIM is aligned and passing. Keep only one _dmarc record for the whole domain.
- 8
(Optional) Add mail-client autoconfig records
For one-click setup in Outlook, Thunderbird, and Apple Mail, Namecheap also lists CNAMEs (mail, autodiscover, autoconfig → privateemail.com) plus an _autodiscover._tcp SRV pointing to privateemail.com on port 443. These only help mail clients auto-configure — they are not part of SPF/DKIM/DMARC authentication and are safe to skip.
- 9
Wait, then test on a real message
Allow about 30–60 minutes for DNS to propagate, then send a message from your Private Email address to a Gmail account and open Show original. You want DKIM: PASS aligned to your domain and DMARC: PASS. SPF will show pass but on Private Email's return-path domain rather than yours — that's expected here, which is exactly why DKIM must be present.
Records to add
Namecheap Private Email generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| MX | @ | mx1.privateemail.comPriority 10 — receives mail. Auto-added on Namecheap BasicDNS. |
| MX | @ | mx2.privateemail.comPriority 10 — second MX, same priority. Auto-added on BasicDNS. |
| TXT | @ | v=spf1 include:spf.privateemail.com ~allOne SPF TXT only — merge into any existing v=spf1 record. This single include costs 4 of your 10 SPF lookups. |
| TXT | privateemail._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA… (generated in your Private Email panel)Illustrative — the exact value is per-account. Host is privateemail._domainkey on subscriptions from June 2, 2026, or default._domainkey on older ones. DKIM is what makes DMARC pass here. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comOne per domain. Start at p=none; your DMARC pass rides on DKIM because SPF doesn't align. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Namecheap Private Email's setup costs against that budget.
Namecheap Private Email adds 4 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM for Private Email is a TXT record (not a CNAME) that you generate inside the Private Email panel — there is no universal key to paste, and the value doesn't exist until you create it. In your Namecheap account go to Private Email → Manage next to the subscription → DKIM section → Generate; Namecheap produces an RSA public key and shows the host and value. The host (selector) depends on when the subscription was purchased: privateemail._domainkey for subscriptions created on or after June 2, 2026, and default._domainkey for anything older — always copy the selector your own panel displays rather than assuming. The value is a single string beginning v=DKIM1; k=rsa; p= followed by the base64 public key; enter it without surrounding quotes or brackets. If your domain uses Namecheap BasicDNS, the DKIM TXT is published automatically the moment you generate it; on PremiumDNS, cPanel/Web Hosting DNS, or any third-party DNS host (Cloudflare, GoDaddy, etc.) you add the TXT record by hand. Because Private Email's SPF doesn't align to your domain, this DKIM record is not optional decoration — it is the only mechanism that produces DMARC alignment, so verify it resolves and passes before tightening DMARC.
DMARC
DMARC is a separate policy record published as a TXT at _dmarc.yourdomain.com on your root domain — one record for the whole domain, regardless of how many senders you use. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com: p=none is monitor-only, so it won't affect delivery while you confirm Private Email mail is passing. The critical point for this provider is that your DMARC result depends entirely on DKIM. Because Private Email uses its own return-path domain, SPF passes but does not align, so DMARC cannot pass on SPF alone — it can only pass through DKIM alignment. Watch your aggregate (rua) reports for a week or two to confirm Private Email consistently shows DKIM aligned and passing, then raise the policy to p=quarantine and eventually p=reject. Don't jump straight to p=reject before you've verified DKIM is aligned and working, or legitimate mail can be rejected.
Check it actually worked
Don't trust propagation timing by eye — wait roughly 30–60 minutes after publishing, then confirm on a real message. Send an email from your Private Email address to a Gmail account, open it, and choose ⋮ → Show original: you're looking for DKIM: PASS signed by your domain and DMARC: PASS. SPF will read pass, but note it's authenticating Private Email's return-path domain, not yours — that's normal here, which is why DKIM must be present and aligned. For a fuller breakdown, send a test to a tool like mail-tester.com, or run your domain through Qualisend's SPF/DKIM/DMARC checker and domain health check to confirm the SPF include resolves (and see that it's eating four lookups), the DKIM selector publishes, and the DMARC record parses. Once aggregate reports start arriving, drop one into the DMARC report analyzer to verify Private Email shows up as an aligned, passing source before you move off p=none.
Common gotchas
- DNS setup
SPF passes but never aligns. Private Email sends with its own return-path domain, so SPF alone can't satisfy DMARC — your DMARC pass depends entirely on DKIM. Generating and publishing the DKIM key is mandatory, not optional.
- Breaks auth
The include is heavier than it looks. include:spf.privateemail.com nests three further includes (ips1, fbrelay, spf-pe.jellyfish.systems) and consumes 4 of your 10 SPF DNS lookups. Add Google Workspace, SendGrid, or Mailchimp on top and you can trip the RFC 7208 PermError limit — keep one SPF record and prune senders you no longer use.
- Coverage
The DKIM selector changed on June 2, 2026. New subscriptions use privateemail._domainkey; older ones use default._domainkey. Copy the exact host from your own panel — don't assume 'default'.
- Coverage
DKIM must be generated first. There's no shared key to paste; the value only exists after you click Generate in the Private Email panel. On newer subscriptions it's available immediately on ordering; on legacy plans you may still need to create a mailbox before it can be generated.
- DNS setup
BasicDNS auto-adds records; other DNS hosts don't. On Namecheap BasicDNS the MX + SPF are added via Advanced DNS → Mail Settings → Private Email and DKIM auto-publishes. If your domain points to Cloudflare, a registrar, or a web host's cPanel, you must add every record manually there instead.
- Breaks auth
Two SPF records is a PermError. If a v=spf1 record already exists on your root, merge include:spf.privateemail.com into it — never publish a second SPF TXT.
- DNS setup
Host-field doubling. Some DNS editors auto-append your domain, turning default._domainkey into default._domainkey.yourdomain.com.yourdomain.com. Enter just @, the bare selector, or _dmarc if the panel adds the domain for you.
- Coverage
Private Email is a mailbox host, not a bulk ESP. For newsletters or cold outreach, send through a dedicated provider and authenticate that separately — routing campaigns through Private Email risks its sending limits and your mailbox reputation.
Build your SPF record
Namecheap Private Email is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listNamecheap Private Email SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.