How do I set up SPF, DKIM and DMARC for my email?

First list every service that sends email for your domain and confirm which provider manages its DNS. For mail sent through our cPanel hosting, open Email Deliverability → Manage beside the domain to review its SPF and public DKIM record. Publish the correct records at the active DNS provider, keeping one SPF record per sending name. Start a new DMARC setup with monitoring, not an untested quarantine or reject policy. Existing policies need review before you change them.

Identify your senders and DNS provider

List all the services sending as your domain: hosting mailboxes, your website, invoicing software, newsletters and any external email provider. Obtain each service's own SPF and DKIM instructions. Authorising only the cPanel server can break another sender.
Check the domain's nameservers with its registrar. For a domain registered with us, open your account, choose Domains, select the domain and open DNS & nameservers. Use our DNS guide to find the correct editor.
Make changes with the provider responsible for those nameservers. A domain appearing in cPanel does not mean cPanel controls its public DNS. Do not switch nameservers or replace MX records just to add authentication.
Keep a copy of the existing SPF, DKIM and DMARC records before editing them. If your domain already has a DMARC policy, have the person responsible for its email review it rather than weakening or replacing it blindly.

Prepare SPF and DKIM

For mail sent through our hosting, open Services, choose Log in to cPanel for the correct service and open Email Deliverability. Choose Manage beside the domain and review its SPF and DKIM status and suggested record names and values.
SPF authorises sending systems. Find the existing TXT record beginning v=spf1 for the exact sending name. Combine all approved senders into one valid policy for that name; do not create a separate SPF record for each service or join two complete policies together. Ask us or your email provider to review a combined record before saving it.
DKIM signs outgoing messages. Publish the record name and public value supplied by each sending service, using the record type that service specifies. Different services can use different DKIM selector names on the same domain. Do not overwrite another service's record just because both are for DKIM.
For a domain using external DNS, copy the public record details to that provider's editor. A cPanel Repair action cannot by itself update DNS controlled elsewhere. Do not use a suggested repair until you have checked that it preserves the complete sender list.
Publish only public DNS values. DKIM private keys, mailbox passwords and email-service API keys do not belong in a TXT record, screenshot or support message.

Add a new DMARC monitoring record

DMARC checks whether authenticated mail matches the domain shown in the message's From address. Set up and verify your legitimate senders' SPF and DKIM first. A pass for an unrelated domain does not by itself satisfy that match.
Choose a dedicated report mailbox on your own domain that you control and can review. Create it before using its address for reports. Reports can be numerous and contain information about your sending systems; keep access limited to the people responsible for email.
For a domain with no existing DMARC record, use a monitoring policy such as v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com, replacing the entire example address with your own working report mailbox. Do not paste the example unchanged. A report destination on another domain needs that destination's authorisation.
When our hosting nameservers manage DNS, open cPanel → Zone Editor → Manage beside your domain. Use the TXT filter to check for an existing _dmarc record. Choose Edit for the intended existing record or Add Record for a new one. Set Type to TXT, Name to _dmarc.your-domain using your complete actual domain, and Text to the reviewed policy. Keep the existing TTL unless your email provider instructs a change, then choose Save Record.
When another provider manages DNS, enter the same reviewed record in its editor using that provider's name format. Some editors append the domain automatically, so check the final name rather than accidentally adding the domain twice. Keep one DMARC TXT policy at that name.

Verify before enforcing a stricter policy

Reopen the records at the active DNS provider and check the full names and saved values. Use each sending service's authentication verification, then check real messages from every approved sender. DNS changes can take time to appear on other networks.
Review the DMARC reports with your email administrator. Keep monitoring until legitimate senders are identified and correctly authenticated. Move to quarantine or reject only after that review and a planned check of the effect on ordinary mail. p=none requests monitoring; it does not block spoofed mail on its own.
Authentication supports trustworthy delivery but does not guarantee that every message reaches the inbox. If verification fails, open Support → New Ticket, set Department to Tech/Server, choose Priority and enter Subject and Message with the domain, sending services, DNS provider and exact warning, then choose Open ticket. Keep private keys and passwords out of the ticket.