SPF, DKIM and DMARC are three DNS records that prove your email really comes from your domain. Together they stop others sending mail in your name and help your genuine mail reach the inbox, and Gmail, Yahoo and Outlook.com now expect them. This page explains what each one does in a few lines, what is already set up on Domain India hosting, and which full guide to follow for each record.
SPF is one TXT record at your domain's root listing the servers allowed to send your mail. DKIM signs each message with a key published at selector._domainkey.yourdomain.com. DMARC is a TXT record at _dmarc.yourdomain.com that tells receivers what to do when a message fails and sends you reports. On Domain India cPanel hosting, DKIM is on by default for new accounts and Email › Email Deliverability checks SPF and DKIM for you. Start DMARC at p=none and tighten it only after the reports are clean.
Each record has its own step-by-step guide: SPF, DKIM and setting up DMARC. This page is the short overview.
1. What each record does
| Record | Where it lives | What it proves | Common mistake |
|---|---|---|---|
| SPF | TXT at your domain's root, starting v=spf1 | The sending server is allowed to send for your domain | Two SPF records, or more than 10 DNS lookups |
| DKIM | TXT at selector._domainkey.yourdomain.com | The message was signed by your domain and not changed in transit | The key is published in DNS nobody queries |
| DMARC | TXT at _dmarc.yourdomain.com, starting v=DMARC1 | The visible From domain matches a passing SPF or DKIM check, and what to do if not | Two DMARC records, or jumping straight to p=reject |
SPF on its own does not protect the From address people see; DMARC is what ties SPF and DKIM to it. Set up SPF and DKIM first, then DMARC.
2. What is already set up on Domain India hosting
- cPanel: DKIM is on by default for new accounts, with the selector
default. Open Email › Email Deliverability to see whether SPF and DKIM are valid and the exact records your domain needs; if the domain uses our hosting nameservers, it can install them for you. Most domains on our cPanel servers already have ap=noneDMARC record, so edit it rather than adding a second one. - DirectAdmin: DKIM uses the selector
x, and most domains already have a key. You normally add the DMARC record yourself. See how to check and manage DKIM in DirectAdmin. - Business Email: every message is DKIM-signed, and SPF and DMARC records are provided for your domain. See DNS records for Business Email.
A record only works in the DNS your domain really uses. If the domain uses our hosting nameservers, edit it in your control panel. If it points to Cloudflare or another DNS provider, add it there. Records saved anywhere else have no effect. See how to change your domain's DNS settings.
3. Check your records in two minutes
- Look them up.Run
dig +short TXT yourdomain.com(SPF),dig +short TXT default._domainkey.yourdomain.com(DKIM on cPanel; usexon DirectAdmin) anddig +short TXT _dmarc.yourdomain.com(DMARC). On Windows, usenslookup -type=TXTwith the same names. - Count them.You should see exactly one line starting
v=spf1and exactly one startingv=DMARC1. - Test real mail.Send a message from your mailbox to a Gmail address, open it and choose Show original. Look for
SPF: PASS,DKIM: PASSandDMARC: PASS.
4. Roll DMARC out safely
Begin with v=DMARC1; p=none; rua=mailto:[email protected] and read the reports for two to four weeks. Make every genuine sender pass (your hosting mail server, newsletter tool, billing or CRM system, website forms). Then move to p=quarantine, optionally with pct=25 rising to 100, and finally to p=reject. The full method is in setting up DMARC.
Two things to know on our servers: on cPanel, SRS is off, so mail forwarded from a cPanel mailbox to an outside address relies on DKIM to pass DMARC; and our shared mail servers do not enforce DMARC on the mail you receive, so DMARC protects how other providers treat mail in your name, not your own inbox.
5. Where Domain India fits
Every Domain India shared hosting plan includes mailboxes on your domain and DNS editing for domains on our hosting nameservers, so you can publish all three records yourself. Shared hosting is not for bulk mail: outgoing mail is limited to 200 messages per hour per account on cPanel and 1,000 per day on DirectAdmin. For newsletters, use a dedicated sending service and authorise it in SPF and DKIM before you tighten DMARC.
If you want mail kept separate from your website, Business Email is priced per mailbox and signs every message with DKIM. The card shows the Domain India list price, excluding 18% GST.
- Priced per mailbox - start with one
- Email at your own domain ([email protected])
- Add and remove mailboxes yourself
- Webmail with calendar, contacts and tasks
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM signs each message with a key published in your DNS. DMARC checks that SPF or DKIM passes for the domain in the visible From address, tells receivers what to do when it fails, and sends you reports.
Is DKIM enabled on Domain India cPanel hosting?
Yes. DKIM is on by default for new cPanel accounts, with the selector default. Check it under Email, then Email Deliverability, in cPanel.
What DKIM selector does Domain India DirectAdmin hosting use?
The selector is x, so the record is at x._domainkey.yourdomain.com. Most domains on our DirectAdmin server already have a key.
Can my domain have two SPF or two DMARC records?
No. Two SPF records make SPF fail, and two DMARC records make DMARC invalid. Merge them into one record of each kind.
Which DMARC policy should I start with?
Start with p=none and a report address, read the reports for a few weeks, then move to p=quarantine and finally p=reject once all your genuine mail passes.
Where do I add SPF, DKIM and DMARC records?
Wherever your domain's DNS is actually managed: your hosting control panel if the domain uses our hosting nameservers, otherwise your DNS provider such as Cloudflare.
Ready to check your domain? Run the lookups above, then follow the full guides for SPF, DKIM and DMARC, or the email deliverability deep-dive. If a record will not validate, open a support ticket with your domain name.
Tell us your domain and where its DNS is managed, and we will check your email authentication records with you.
Open a support ticket