> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hostcloud.in/llms.txt
> Use this file to discover all available pages before exploring further.

# SPF, DKIM and DMARC explained

> What these three email records do, why they matter, and how to set them up for your domain.

SPF, DKIM and DMARC are DNS records that prove the emails sent from your domain are really from you. Without them, your emails are more likely to land in spam, and scammers find it easier to fake your address. This guide explains each one in plain English.

## In one sentence each

| Record | What it does | Like… |
| - | - | - |
| **SPF** | Lists which servers are allowed to send email for your domain | A guest list at the door |
| **DKIM** | Adds a digital signature to each email that receivers can check | A tamper-proof seal on an envelope |
| **DMARC** | Tells receivers what to do with emails that fail SPF and DKIM, and sends you reports | The instructions for the doorman |

Gmail, Yahoo and Microsoft now expect all three for reliable delivery.

## SPF

An SPF record is a `TXT` record on your domain. It looks like this:

```
v=spf1 +a +mx include:example-sender.com ~all
```

* Each `include:` or other entry names a service allowed to send for you.
* `~all` at the end means "treat anything else as suspicious".

> [!WARNING]
>
> A domain must have only **one** SPF record. If you use several services, such as HostCloud email plus a newsletter tool, combine them into one record. Two SPF records cause both to fail.

## DKIM

DKIM is also a `TXT` record, with a long key that your email service creates. Each sending service has its own DKIM record, with a different name, so you can have several.

For HostCloud email, cPanel creates DKIM for you.

## DMARC

DMARC is a `TXT` record named `_dmarc.yourdomain.com`. Start in monitoring mode:

| Type | Name | Value |
| - | - | - |
| TXT | `_dmarc.yourdomain.com` | `v=DMARC1; p=none; rua=mailto:you@yourdomain.com` |

| Policy (`p=`) | What receivers do with failing email |
| - | - |
| `none` | Deliver as normal, but report it. Start here |
| `quarantine` | Put it in spam |
| `reject` | Refuse it |

Once reports show that all your genuine email passes, you can move to `quarantine`, and later `reject`, to stop people faking your address.

## Check and fix them for HostCloud email

**1. Open Email Deliverability**

[Log in to cPanel](/cpanel/log-in-to-cpanel.md), type **Email Deliverability** in the **Search Tools** box and open it.

**2. Review your domains**

Each domain shows whether SPF and DKIM are valid. Click **Manage** next to a domain to see details.

**3. Fix problems**

If your domain uses HostCloud nameservers, use **Repair** to fix the records automatically. If your DNS is elsewhere, copy the suggested records to your DNS provider.

Add DMARC yourself in **Zone Editor**. See [Add or edit DNS records](/dns/add-dns-records.md).

## Using another email provider?

If your email is with Google Workspace or Microsoft 365, use the SPF and DKIM values they give you. See [Set up Google Workspace or Microsoft 365 email](/dns/google-workspace-microsoft-365-mx.md).

Related: [Fix emails going to spam](/email/fix-emails-going-to-spam.md)

Still stuck? [Open a ticket](/support/open-a-ticket.md) with your domain name.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.