SPF, DKIM and DMARC are DNS records that help other mail servers trust your email. On StackCP and Business Email you add one SPF record, turn on DKIM in DomainKeys (DKIM), and create DMARC with the DMARC Wizard. DKIM and DMARC are not set up by default.
What each record does
| Record | Type | What it does |
|---|---|---|
| SPF | TXT | Lists the servers that may send email for your domain. |
| DKIM | TXT | Adds a digital signature to your email so receivers can check it was not changed. |
| DMARC | TXT | Tells receivers what to do if SPF or DKIM checks fail, and where to send reports. |
StackCP and Business Email
Step 1: SPF
The SPF record is always the same for StackCP and Business Email.
| Field | Value |
|---|---|
| Name | Leave empty (the root of your domain). Some DNS editors use @. |
| Type | TXT |
| Value / Data | v=spf1 include:spf.stackmail.com a mx -all |
v=spf1 include:spf.stackmail.com a mx -all- Log in to StackCP and open Manage DNS for your domain (or open your DNS provider, for example Cloudflare).
- Look for an existing TXT record that starts with
v=spf1. - If there is no SPF record, add a new TXT record with the values from the table above.
- If there is already an SPF record, do not add a second one. Merge both into one record (see the note below).
- Save the record.
Important: A domain may have only one SPF record. Two v=spf1 records break SPF for all your email. If you also send email from another service, add its include: to the same record. For example, v=spf1 include:_spf.google.com ~all and our record become: v=spf1 include:spf.stackmail.com include:_spf.google.com a mx -all
Step 2: DKIM
- Log in to StackCP.
- Open DomainKeys (DKIM).
- Turn on DKIM for your domain.
- If your domain uses the StackCP nameservers, StackCP adds the DKIM record to your DNS automatically. You don't need to do anything else.
- If your DNS is managed somewhere else (for example Cloudflare), copy the DKIM record and add it there by hand (see the box below).
Step 3: DMARC
- Log in to StackCP.
- Open DMARC Wizard.
- Create a DMARC record for your domain. Start with the policy
p=none. - If your DNS is managed somewhere else (for example Cloudflare), copy the DMARC record and add it there by hand (see the box below).
p=none means "monitor only": receivers do not block or move anything yet, they only check SPF and DKIM. When you are sure all your real email passes, you can make the policy stricter (p=quarantine, then p=reject).
Important — using Cloudflare (or another DNS provider)? StackCP cannot write records into a DNS zone that is managed somewhere else. Without these steps, DKIM and DMARC will not work.
- Generate DKIM in StackCP → DomainKeys (DKIM) and DMARC in StackCP → DMARC Wizard.
- Copy the exact records: Name, Type and Value.
- In Cloudflare DNS (or your DNS provider), add each one by hand as a TXT record, set to DNS only (grey cloud).
- Add the SPF record from Step 1 there in the same way.
Step 4: Check
- Wait from 30 minutes up to a few hours for the DNS changes.
- Send a test email to a checking tool such as mail-tester.com to see your score.
cPanel
On cPanel hosting the correct values depend on your server. Log in to cPanel and open Email Deliverability. It shows the SPF and DKIM status of your domain and the suggested records. You can see and edit the records in Zone Editor (the DNS zone of your domain).
DMARC (cPanel) — TXT record, name _dmarc. Start with a "monitor only" policy:
v=DMARC1; p=noneIf your domain uses Cloudflare or another DNS provider, copy the records from cPanel and add them there by hand as TXT records.
Prefer that we do it?
Open a support ticket with your domain name. We can add SPF, DKIM, DMARC and MX records for you. If something does not work after you add the records, open a ticket and we will check it.