cPanel Email Going to Spam? How to Fix SPF, DKIM and DMARC

cPanel Email Deliverability checks whether your domain's SPF, DKIM, and DMARC records authenticate mail sent from your hosting server. Open it under Email, select your domain, repair or copy the recommended DNS records (never use another domain's values), and wait for DNS propagation. Mailbox content, sending volume, and reputation also affect whether mail lands in spam.

Configure Outlook after DNS fixes: (/blog/configure-webmail-in-outlook). Mail SSL issues: (/blog/outlook-configuration-known-issues). DNS records: (/blog/manage-dns-records-cpanel-zone-editor).

---

Key Takeaways

• Email Deliverability is the starting point for authentication status
• SPF lists authorized senders; DKIM signs messages; DMARC sets policy
• Only one SPF TXT record per domain
• Copy records to external DNS if nameservers are not at Pakish
• PTR/reverse DNS is controlled by the server administrator
• Google Workspace / Microsoft 365 use their own authentication setup

---

Before You Start

| Item | Details | |---|---| | DNS control | Pakish Zone Editor or external DNS panel | | Domain | example.com you send mail from | | Test mailbox | Gmail and Outlook accounts for placement tests |

Create or confirm a usable backup of DNS records before editing. Availability and limits may vary by hosting plan or server configuration.

---

Check Email Deliverability Status

1. cPanel → Email → Email Deliverability
2. Select example.com
3. Review status for:

| Check | Purpose | |---|---| | SPF | Authorizes sending servers | | DKIM | Cryptographic domain signature | | DMARC | Policy for failed authentication | | Reverse DNS (PTR) | May show advisory — server-level |

Green/valid = good. Invalid = follow repair steps.

---

SPF Purpose and Fix

SPF (Sender Policy Framework) tells receiving servers which hosts may send mail for your domain.

When Pakish controls DNS:

1. Click Repair next to SPF in Email Deliverability
2. Or copy the suggested TXT record to (/blog/manage-dns-records-cpanel-zone-editor)

External DNS: Copy the exact TXT value shown for your domain into your provider's DNS panel.

Never publish multiple SPF TXT records — merge includes into one record.

---

DKIM Purpose and Fix

DKIM adds a digital signature proving the message was authorized by your domain.

1. Email Deliverability → DKIM section
2. Install or Repair the suggested DKIM TXT record
3. Save in Zone Editor or external DNS
4. Allow (/blog/dns-propagation-tips-tricks)

---

DMARC Purpose and Fix

DMARC tells receivers what to do when SPF/DKIM fail and enables reporting.

Prerequisites: SPF and DKIM should pass first.

1. Email Deliverability → DMARC
2. Start with a monitoring policy (p=none) if offered
3. Add the DMARC TXT record at _dmarc.example.com
4. Increase strictness gradually after monitoring reports

---

PTR and Reverse DNS Limitations

Reverse DNS (PTR) maps your sending IP to a hostname. On shared hosting, PTR is managed by the hosting provider — you cannot edit it in Zone Editor. HELO/EHLO mismatch warnings may require server administrator changes. Contact Pakish support if PTR is flagged.

---

HELO Mismatch Explanation

If the SMTP server introduces itself with a hostname that does not match PTR or the sending domain, some filters score mail lower. This is typically a server configuration issue, not a mailbox setting.

---

Mailbox and Message Content Factors

Authentication alone does not guarantee inbox placement:

• Avoid spam trigger words and ALL CAPS subjects
• Include a plain-text part in HTML emails
• Warm up new domains gradually — avoid sudden bulk blasts
• Keep bounce rates low; remove invalid addresses
• Use a recognizable From name and reply-to address

For strategic deliverability, see founder's guide to email deliverability.

---

Google Workspace and Microsoft 365 Users

If outbound mail sends through Google or Microsoft, configure SPF/DKIM/DMARC in their admin consoles — not cPanel. cPanel Email Deliverability applies to mail sent from Pakish hosting servers (mail.example.com).

---

Testing Deliverability

1. Send test email to Gmail and Outlook accounts
2. Open message → Show original / View headers
3. Confirm spf=pass and dkim=pass
4. Check if message landed in Inbox vs Spam
5. Use mail-tester.com style tools cautiously — one data point only

---

How to Verify It Worked

• Email Deliverability shows valid SPF, DKIM, DMARC
• DNS checker shows correct TXT records globally
• Test headers show pass for authentication
• Inbox placement improves over subsequent sends (not always instant)

---

Common Problems and Fixes

| Problem | Fix | |---|---| | Multiple SPF records | Merge into one TXT in Zone Editor | | DKIM fail | Reinstall DKIM keys; wait for propagation | | DMARC fail | Ensure SPF/DKIM alignment; check From domain | | Still in spam | Review content, volume, blacklists; contact support | | External DNS | Copy records manually; do not use Repair only |

---

When to Contact Pakish Support

Contact support for PTR/HELO issues, persistent authentication failures after correct DNS, IP reputation blocks, or dedicated sending IP requests. Visit (/professional-email) or (/support).

---

Frequently Asked Questions

Where do I find SPF and DKIM settings in cPanel?

Open cPanel, go to Email, then Email Deliverability. Select your domain and review SPF, DKIM, and DMARC status. Use Repair or copy the recommended DNS records for your domain.

Can I copy the same SPF record from another domain?

No. SPF records are domain-specific and include authorized senders for that domain only. Use the values shown in Email Deliverability for each domain.

Do I need DMARC if SPF and DKIM already pass?

DMARC is strongly recommended. It tells receiving servers how to handle mail that fails SPF or DKIM alignment and improves long-term deliverability reporting.

I use Google Workspace or Microsoft 365 — does this guide apply?

Partially. You configure SPF, DKIM, and DMARC at Google or Microsoft for outbound mail through those services. cPanel Email Deliverability applies when mail sends from Pakish hosting servers.

Will fixing DNS records instantly stop spam folder delivery?

DNS changes need propagation time. Reputation and message content also affect placement. Allow time after DNS fixes and send test messages to multiple providers.

---

Related Guides

• (/blog/cpanel-wordpress-webmail-beginners-guide)
• (/blog/configure-webmail-in-outlook)
• (/blog/outlook-configuration-known-issues)
• (/blog/manage-dns-records-cpanel-zone-editor)
• (/blog/dns-propagation-tips-tricks)

Professional business email with deliverability support — explore (/professional-email).

---

Sources

• (https://docs.cpanel.net/cpanel/email/email-deliverability/)
• (https://docs.cpanel.net/knowledge-base/email/)