Soft2Hosting

Shared Hosting Email Deliverability: Configuring SPF, DKIM & DMARC in cPanel

02 Oct 2026 · 3 min read

Sending corporate emails from your branded domain (such as info@yourcompany.com) is essential for small businesses, agencies, and retail enterprises. However, modern email providers like Google Workspace, Microsoft 365, and Yahoo enforce strict email authentication policies. If your shared hosting domain lacks proper DNS authentication records, legitimate business proposals and invoice notifications will land in client spam folders or be rejected entirely. Configuring SPF, DKIM, and DMARC in cPanel ensures consistent inbox delivery.

The Three Pillars of Modern Email Authentication

Modern receiving mail servers verify sender legitimacy using three complementary authentication standards:

Sender Policy Framework (SPF): A public DNS TXT record that lists the specific IP addresses and mail servers authorized to send email on behalf of your domain. If an email arrives from an unauthorized server claiming to be your domain, the receiver flags it as suspicious.
DomainKeys Identified Mail (DKIM): Adds a cryptographic digital signature to outgoing email headers. The receiving mail server retrieves your domain's public cryptographic key from your DNS records and verifies that the signature matches the message content, confirming that the email was not modified in transit.
Domain-based Message Authentication, Reporting, and Conformance (DMARC): Uses SPF and DKIM validation results to instruct receiving servers on what action to take (none, quarantine, or reject) if an incoming email fails authentication checks.

Step 1: Inspecting the Email Deliverability Interface in cPanel

cPanel provides a dedicated Email Deliverability tool that audits your domain's authentication status and generates required DNS values:

Log in to your cPanel control panel dashboard.
Scroll to the Email section and click on Email Deliverability.
Locate your domain name in the list. If records are missing or misconfigured, cPanel displays a status warning labeled Problems Exist.
Click the Manage button next to your domain to inspect the exact SPF and DKIM values generated for your account.

Step 2: Configuring DKIM Authentication

In the Email Deliverability interface, cPanel automatically generates a 2048-bit DKIM private key on the mail server and presents the corresponding public key as a DNS TXT record.

The record consists of two components:

Name / Host: default._domainkey.yourdomain.com
Record Type: TXT
Value: A formatted string beginning with v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQE...

If your domain's DNS is managed directly within cPanel, click Install The Suggested Record to apply it automatically. If your DNS is hosted on a third-party registrar or Cloudflare, copy the exact Name and Value into your external DNS management panel.

Step 3: Configuring the SPF Record

An SPF record is published as a standard TXT record on your domain's root:

Name / Host: @ (or yourdomain.com)
Record Type: TXT
Value: v=spf1 +ip4:103.x.x.x +a +mx ~all

Crucial Rule: One SPF Record Only

A domain must never publish multiple SPF records. If you use external services alongside cPanel email (such as Google Workspace or an email marketing service), do not create a second TXT record. Instead, combine the sending mechanisms into a single record using the include: directive:

v=spf1 +a +mx include:_spf.google.com ~all

Step 4: Creating a DMARC Policy Record

Once SPF and DKIM are validated, create a basic DMARC policy record in cPanel's Zone Editor to prevent domain spoofing:

Name / Host: _dmarc.yourdomain.com
Record Type: TXT
Value (Monitoring Policy): v=DMARC1; p=none; sp=none; rua=mailto:dmarc-reports@yourdomain.com;

Step 5: Handling Email Forwarders with SRS and Reverse DNS

A common pitfall on cPanel shared hosting involves automated email forwarding. When an employee configures an email forwarder from a corporate domain inbox (e.g., contact@yourcompany.com) to a personal consumer account (such as Gmail or Outlook), the shared mail server re-transmits the incoming message. Without proper handling, receiving providers examine the original sender's SPF record, detect that the forwarding cPanel server's IP is not authorized for that external domain, and reject or spam-box the forwarded message.

To prevent forwarding failures, modern cPanel mail transfer agents implement the Sender Rewriting Scheme (SRS). SRS rewrites the envelope sender address (the Return-Path header) during message relay, aligning the forwarding envelope with your authenticated cPanel host. Furthermore, your hosting provider configures authoritative reverse DNS (PTR records) mapping the shared mail server's public IP address back to its fully qualified domain hostname, satisfying strict recipient validation checks across Gmail, Yahoo, and Microsoft filters.

Best Practices for Shared Hosting Email Reliability

Warm Up New Accounts: Avoid sending hundreds of marketing emails simultaneously from newly registered domains. Build sender reputation by sending normal one-to-one business emails first.
Avoid Forwarding Loops: When creating email forwarders to personal Gmail accounts, automated forwarders can sometimes trigger spam classification. Configure an email client via IMAP/SMTP instead.
Monitor Blacklist Status: Check your domain reputation on free diagnostic tools like MXToolbox to ensure your sending IP maintains a clean record.

Soft2Hosting provides dependable shared hosting plans equipped with full cPanel administration, automated backups, and professional domain email on high-speed NVMe storage.

Discover plan features on Soft2Hosting Shared Web Hosting.