To configure the SPF and DKIM records, log in to cPanel > the Email section > the Email Deliverability menu:

1. Repair — this feature allows the system to repair domain invalid records:

NOTES:

• This option is unavailable if the system does not control the domain DNS records. Thus, you will be able to use the Repair option only in case your domain name is pointed to our Shared hosting nameservers.
• You cannot simultaneously update two or more domains whose records exist in the same zone. The bulk records update is possible only in case domain records exist in separate zones.
• Reloading the interface does not interrupt the repair process.
  

In the window that appears upon clicking Repair, you can review and confirm the system recommendations for any invalid records. You can also Copy or Customize a suggested record before you approve the system repairs. Click on Repair, and the records will be added to the DNS zone of the domain/subdomain automatically:



This process can take up to five minutes, depending on the server. When the records are set up, you will receive a corresponding success message:



Allow some time for the records to propagate and refresh the page afterwards. The Email Deliverability Status will be then changed to Valid:



2. Manage - this option allows you to manually configure the mail-related DNS records of a domain.

The Manage the Domain section already displays the properly-configured DKIM, SPF and DMARC record values. So in most cases, you just need to Copy them and paste manually to the DNS zone of your domain. Alternatively, you can click Install the suggested record to have the records added to the DNS zone automatically:

NOTE: The Install the suggested record option is available only in case your domain name is pointed to our Shared hosting nameservers.



After the record is installed, you will receive the confirmation message:




After configuring the SPF and DKIM records, you can move on to setting up the DMARC record.

• DMARC

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a technical protocol designed to prevent email abuse such as phishing and spoofing. It works by using DNS to verify that an email aligns with valid SPF and DKIM records, ensuring that the “From” header — also known as the 5322. From or Display From address — is consistent with those records. By doing so, DMARC helps detect and block attempts to forge sender identities, thereby reducing the risk of fraudulent emails reaching recipients.

Many major email providers now require domains to implement a valid DMARC policy to protect users from spam and phishing. Without proper configuration, legitimate messages from your domain may be flagged as spam or even rejected by mail servers.

NOTE: For DMARC to work correctly, your domain must have valid SPF and DKIM records.

A default DMARC record installed for domains in cPanel looks like the following:

Name: _dmarc.example.com
Type: TXT
Value: v=DMARC1;p=none;

Below is a breakdown of what each tag in this record means:

Tag	Parameter	Description
v=DMARC1	Version	Specifies the DMARC protocol version. It must always be DMARC1.
p=none	Policy for the domain	Instructs receiving mail servers to take no action (i.e., only monitor and report) when a message fails DMARC checks. Other possible values are: p=quarantine - moves to spam/junk p=reject - blocks the email.

This configuration allows you to monitor DMARC results. It’s typically used as a starting point before enforcing a full quarantine or reject policy across the domain.

If you need to set a custom record, you can always use a DMARC generator tool.

To create a DMARC record for a domain hosted with Namecheap, log in to your cPanel account > navigate to the Zone Editor menu and create the corresponding record as a TXT one as it’s described here.