SPF, DKIM & DMARC Overview for Email Deliverability

If your emails are landing in spam or bouncing, the cause is often missing or misconfigured SPF, DKIM and DMARC records. These three DNS records work together to prove to receiving mail servers (Gmail, Outlook, etc.) that mail from your domain is legitimate and not forged.

SPF — who's allowed to send for your domain

SPF (Sender Policy Framework) is a DNS TXT record listing which mail servers are authorized to send email on behalf of your domain. When another server receives mail claiming to be from you, it checks your SPF record — if the sending server isn't listed, the mail is more likely to be flagged as spam or rejected. Hoststack automatically adds a correct SPF record when email hosting is set up on a domain; if you also send through a third-party service (like a marketing platform or CRM), that provider's server needs to be added to the same SPF record too.

DKIM — a digital signature on every email

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails, generated using a private key on the mail server and verified using a public key published in DNS. This proves the message wasn't altered in transit and genuinely originated from your mail server. DKIM is enabled automatically for Hoststack email accounts — you can view or reset the DKIM key from cPanel's Email Deliverability tool if needed.

DMARC — telling receivers what to do with failures

• DMARC ties SPF and DKIM together and tells receiving servers what to do if a message fails both checks
• p=none just monitors and reports failures without blocking anything — a safe starting point
• p=quarantine sends failing mail to spam; p=reject blocks it outright
• Google and Yahoo now require at least a basic DMARC record for bulk senders, so it's worth adding even at p=none

Checking your records

In cPanel, open Email Deliverability under the Email section — it shows the exact SPF, DKIM and DMARC records expected for your domain and flags anything missing or incorrect at the DNS level. You can also verify propagation with our DNS Lookup tool. If your domain uses Hoststack nameservers, these records are usually added automatically; if your DNS is managed elsewhere, you'll need to copy the exact values shown in cPanel into your external DNS provider.