This older video shows the tool, although the screens have changed since 2019:
Why these records matter
| Record | What it proves | What happens without it |
|---|---|---|
| SPF | Which servers may send mail for the domain | Receivers cannot tell your mail from forged mail |
| DKIM | That the message was signed by the domain and not changed | Lower trust, more mail in spam |
| PTR (reverse DNS) | That the sending IP belongs to a named mail server | Many receivers reject or delay mail |
| DMARC | What receivers should do when SPF and DKIM fail | Forged mail using your domain is more likely to be accepted |
Since 2024, Gmail and Yahoo require SPF or DKIM for all senders, and SPF, DKIM and DMARC for bulk senders.
Step 1: open Email Deliverability
- Log in to WHM as root, or to cPanel as the account owner.
- Open Email > Email Deliverability.
- Look at the status for each domain. Domains with problems are listed first.
Step 2: repair records in local DNS
If the server hosts the domain’s DNS zone, click Repair (or Repair All in WHM). cPanel writes the recommended SPF and DKIM records into the zone. Click Manage on a domain to see the exact records and any warnings.
Step 3: copy records to external DNS
If the domain’s nameservers point elsewhere, cPanel cannot change the records. Click Manage, copy the “suggested” values, and add them at your DNS provider. A typical SPF record looks like this:
example.com. TXT "v=spf1 +a +mx +ip4:203.0.113.10 ~all"Each domain must have only one SPF record. If you also send through other services, such as a newsletter tool or Google Workspace, merge their include: entries into that one record.
Step 4: fix reverse DNS
The PTR record belongs to whoever owns the IP address, which is your hosting provider. The tool shows the name the IP should point to, usually the server hostname. Ask support to set it, and make sure the hostname also points back to the IP with an A record.
Step 5: add DMARC
Email Deliverability focuses on SPF, DKIM and PTR. Add a DMARC record yourself in the Zone Editor, starting in monitoring mode:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"Read the reports for a few weeks. When legitimate mail passes, move to p=quarantine and later p=reject.
Step 6: test
- ✓ Send a message to an external mailbox, open the original message or headers, and check that SPF, DKIM and DMARC show pass.
- ✓ Use an online mail tester to check the message and the server’s blocklist status.
- ✓ Re-check Email Deliverability after DNS changes have had time to update.
Domains that do not send mail
Parked or unused domains are easy targets for forgery because nobody watches them. Publish an SPF record that allows no senders, v=spf1 -all, and a DMARC record with p=reject, so receivers refuse mail that claims to come from them.
Common warnings
| Warning | Cause | Fix |
|---|---|---|
| SPF: too many DNS lookups | More than 10 include or lookup terms | Remove unused includes or combine services. |
| SPF: multiple records | Two TXT records starting with v=spf1 | Merge them into one. |
| DKIM: key missing or wrong | The record was not copied to external DNS, or was cut | Copy the full key again, as one TXT value. |
| PTR: does not match | Reverse DNS points to another name | Ask your host to set the PTR to the server hostname. |
For outgoing IP changes and smart hosts, see our guides to changing the outgoing mail IP and using a smart host.
Need help with this?
Email landing in spam? Our team can check SPF, DKIM, DMARC and reverse DNS for your domains.
Frequently asked questions
Where is Email Deliverability in cPanel?
Under Email > Email Deliverability, in both WHM and cPanel.
Why can I not repair a domain?
Its DNS is hosted elsewhere. Copy the suggested records to your DNS provider.
Can a domain have two SPF records?
No. Merge all senders into one SPF record.
Who sets the PTR record?
The owner of the IP address, usually your hosting provider. Ask support.
Does Email Deliverability set up DMARC?
Add DMARC yourself in the Zone Editor, starting with p=none.
Related guides
