SPF, DKIM and DMARC on cPanel: meeting Gmail, Yahoo and Outlook rules in 2026

Now that Gmail, Yahoo and Microsoft strictly enforce their authentication rules, a poorly configured domain no longer just lands in spam: its messages can be refused outright. The good news is that cPanel now brings SPF, DKIM and DMARC together on a single page. This guide takes you from a first health check all the way to a DMARC policy of p=reject, with reports to back every step.

What Gmail, Yahoo and Microsoft require in 2026

All three major mailbox providers separate rules for every sender from rules for high-volume senders. Here is a summary based on their official documentation as of October 2026.

Requirement	Gmail	Yahoo	Outlook.com / Hotmail
All senders	SPF or DKIM, valid forward and reverse DNS (PTR), TLS, spam rate < 0.3%	SPF or DKIM, valid forward and reverse DNS, spam rate < 0.3%	Recommended best practices
High-volume threshold	Around 5,000 messages a day to Gmail accounts	No published figure ("significant volume")	5,000 or more messages to Microsoft consumer services
High volume: authentication	SPF and DKIM, DMARC at least `p=none`, From domain alignment	SPF and DKIM, DMARC at least `p=none`, relaxed alignment accepted	SPF and DKIM passing, DMARC published and passing
Unsubscribe	One-click (List-Unsubscribe headers) plus a visible link	One-click, honoured within 2 days	Recommended
Consequence	Temporary or permanent rejections, or spam folder placement	Filtering or rejection	Rejection with error `550 5.7.515`

Google states in its FAQ that from November 2025, Gmail ramped up enforcement of these rules: non-compliant messages now face temporary and permanent rejections. Gmail also recommends a DKIM key of at least 1024 bits, ideally 2048 bits, and a spam rate ideally below 0.1%.

Why small websites are affected too

Not sending 5,000 messages a day? The "all senders" rules still apply, and a domain without DMARC is an easy target for spoofing: anyone can send a fake email in your name. WordPress contact forms, PrestaShop order confirmations and newsletters go through the same filters as your personal email. Setting up all three records takes less than an hour and protects you for the long term.

SPF, DKIM and DMARC: what each one does

SPF lists the servers allowed to send for your domain. It is checked against the envelope address (Return-Path), not the address people see.
DKIM adds a cryptographic signature to each message. The recipient verifies it using the public key published in your DNS.
DMARC ties both to the visible address (the From domain). A message passes DMARC if SPF or DKIM passes and the verified domain matches the displayed one: this is called alignment. DMARC also says what to do on failure and where to send reports.

The most common trap: a valid SPF record is not enough if the Return-Path belongs to another domain, such as your newsletter provider's. Without DKIM signed with your own domain, DMARC fails.

Step 1: run a health check in cPanel

Log in to cPanel, open the Email section, then Email Deliverability.
The table lists your domains with a deliverability status column. A domain flagged with problems has an issue with DKIM, SPF, DMARC or reverse DNS.
Click Manage to see the details: each record is compared with the one cPanel suggests.

The Repair button automatically fixes invalid records once you approve the changes. It is only available when the server manages the domain's DNS zone. If your nameservers are elsewhere (at your registrar or a CDN service), copy the suggested records and add them with that provider.

The DMARC section on this page is available in recent cPanel versions (version 130 and later). On an older version, add the DMARC record manually in the Zone Editor.

Step 2: set up SPF

In the SPF section of the Manage page, cPanel suggests a record tailored to your server. For a domain that only sends from your hosting account, it looks like this:

yourdomain.com.  14400  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.10 ~all"

If you also use an external service (newsletter tool, collaboration suite), click Customize to add the include that service provides, then Install a Customized SPF Record:

yourdomain.com.  14400  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.10 include:_spf.example-service.com ~all"

Three rules to follow:

Only one SPF record per domain. Two v=spf1 records make SPF invalid.
Ten DNS lookups maximum. Every include, a or mx uses one; beyond that, SPF returns an error.
~all or -all? cPanel suggests ~all (soft fail) by default. Once DMARC is in place, DMARC decides what happens to messages: ~all remains the cautious choice until you are sure every source is listed.

Step 3: enable and publish DKIM

In the DKIM section, click Generate Local DKIM Key if no key exists. cPanel then signs outgoing mail from your hosting account with the default selector. The public record looks like this:

default._domainkey.yourdomain.com.  14400  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB"

If your DNS is managed elsewhere, use Copy and paste the value at your DNS provider (the "Split" format breaks a long key into several strings if your interface requires it). Never publish the private key: cPanel can display it, but it must stay on the server.

Every external service that sends on your behalf must also sign with your domain, using its own selector (for example s1._domainkey). Unlike SPF, several DKIM selectors can coexist without any issue.

Step 4: publish DMARC in monitoring mode

First, create an email address in cPanel reserved for receiving reports, for example [email protected]: you will get several a day. Then, in the DMARC section, install the suggested record or adjust it in the Zone Editor:

_dmarc.yourdomain.com.  14400  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r"

p=none: no action on failing messages, you only observe.
rua: the address that receives daily aggregate reports.
adkim=r and aspf=r: relaxed alignment, which accepts subdomains (a Return-Path on bounce.yourdomain.com still aligns).

cPanel points out that DMARC is only fully active when SPF and DKIM are already valid, so finish steps 2 and 3 first.

Step 5: read your DMARC reports

Aggregate reports arrive as a compressed attachment (.zip or .gz) containing an XML file. Each provider (Google, Yahoo, Microsoft and others) sends its own, usually once a day. Here is the part that matters:

<record>
  <row>
    <source_ip>198.51.100.25</source_ip>
    <count>137</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>fail</dkim>
      <spf>pass</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>yourdomain.com</header_from>
  </identifiers>
</record>

Read it like this: 137 messages showing your domain were sent from IP address 198.51.100.25. SPF is aligned, DKIM is not, so DMARC passes thanks to SPF. For each source IP, ask yourself three questions:

Do I recognise this source? Your cPanel server, your newsletter tool, your invoicing software... If so, it is legitimate mail to fix.
If legitimate, what is failing? No DKIM: enable signing with your domain in that service. SPF not aligned: add its include or set up a Return-Path on your domain.
If unknown, is it spoofing? Volumes from unknown IPs failing both SPF and DKIM are exactly what p=reject will block.

Reading XML by hand quickly gets tedious: many DMARC report analysers, free or paid, turn these files into tables per source. What matters is checking them every week during the rollout.

Step 6: move from p=none to p=reject safely

Tightening the policy too early makes your own legitimate mail disappear. Move forward in stages:

Stage	Record	Suggested duration	Condition to move on
1. Monitoring	`p=none`	2 to 4 weeks	All legitimate sources identified and aligned
2. Quarantine	`p=quarantine`	2 to 4 weeks	No complaints about legitimate mail in spam, stable reports
3. Reject	`p=reject`	Permanent	Monthly report reviews

; Stage 2
_dmarc.yourdomain.com.  14400  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r"

; Stage 3
_dmarc.yourdomain.com.  14400  IN  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]; adkim=r; aspf=r"

The sp=reject tag applies the same rule to subdomains, which spoofers happily exploit when they are left unprotected. The pct tag, once a common trick for gradual rollouts, is no longer part of the new version of the DMARC standard (RFC 9989, published in 2026): rely on full stages and long enough observation periods instead.

Check with a real message

Send an email from your cPanel mailbox to a Gmail address, open it and choose Show original. Gmail displays SPF, DKIM and DMARC with PASS or FAIL. In the full headers, look for the Authentication-Results line:

Authentication-Results: mx.google.com;
  dkim=pass [email protected] header.s=default;
  spf=pass smtp.mailfrom=yourdomain.com;
  dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=yourdomain.com

Run the same test from your website: contact form, password reset, test order. Emails sent through PHP without authentication sometimes leave with an envelope address tied to the hosting account rather than your domain. Configure your CMS to send through authenticated SMTP with a real address on your domain, and SPF and DKIM will align.

The most common rejection errors

5.7.26 at Gmail: the message is not authenticated (neither SPF nor DKIM valid and aligned). Go back to the health check in step 1.
550 5.7.515 at Microsoft: the sending domain does not meet the authentication level required for high-volume senders. SPF and DKIM must both pass, and DMARC must be published and pass.
DMARC fails while SPF passes: the Return-Path belongs to a provider's domain. Enable DKIM with your domain at that provider.
DKIM fails after a migration: the key was regenerated on the new server but the old value is still published in your external DNS.
Missing or inconsistent PTR: the Reverse DNS section of the Manage page shows it. This record depends on whoever owns the IP address, so on your hosting provider.

FAQ

Is DMARC with p=none enough for Gmail and Outlook?

Strictly speaking, yes: Gmail, Yahoo and Microsoft accept p=none as the minimum. But that policy does not protect your domain against spoofing. Aim for p=reject once your legitimate mail is aligned.

How long do changes take to apply?

The Email Deliverability page rechecks records within a few minutes after a repair. On the recipient side, allow for the TTL of your DNS records to expire, usually a few hours.

What if the Repair button does not appear?

Your DNS zone is not managed by the cPanel server. Copy the suggested records and add them with the provider that runs your nameservers.

Do I need a DMARC record for every subdomain?

No. The main domain's record applies to subdomains, and the sp tag lets you give them their own policy.

Do DMARC reports contain the content of my emails?

No. Aggregate reports (rua) only contain statistics: IP addresses, volumes and SPF, DKIM and DMARC results.