If mail from your domain lands in junk folders or bounces outright, the cause is almost never the content of the message. It is that receiving servers cannot verify the mail genuinely came from you. Three DNS records solve this: SPF, DKIM and DMARC. This guide explains what each one does, how to publish it correctly on Fast Hive, and how to verify it is working.
- SPF - lists which servers are allowed to send mail for your domain.
- DKIM - cryptographically signs your mail so it cannot be altered or forged.
- DMARC - tells receivers what to do when SPF or DKIM fails, and asks them to report back.
Step 1 - Check what you have today
Run these from a terminal before changing anything:
nslookup -type=TXT yourdomain.com 8.8.8.8
nslookup -type=TXT _dmarc.yourdomain.com 8.8.8.8
nslookup -type=TXT default._domainkey.yourdomain.com 8.8.8.8The first shows your SPF record, the second your DMARC policy, and the third your DKIM public key. Anything missing is a gap to close.
Step 2 - SPF
cPanel can manage this for you. Open Email → Email Deliverability, find your domain, and if SPF shows a problem click Repair. cPanel installs a correct record automatically.
To write it yourself, add a TXT record on @:
v=spf1 +mx +a ~allIf you also send through outside services - a newsletter platform, a CRM, a transactional mail provider - include them in the same record:
v=spf1 +mx +a include:spf.example-newsletter.com include:_spf.example-crm.com ~all| Element | Meaning |
|---|---|
v=spf1 | Version marker. Every SPF record starts this way. |
+mx | Allow the servers listed in your MX records. |
+a | Allow the server your A record points to. |
include: | Trust another provider's published senders. |
~all | Soft fail - treat anything else as suspicious. Safer than -all while you are still finding all your senders. |
include: counts. Exceed ten and SPF fails permanently.
Step 3 - DKIM
DKIM signs every outgoing message with a private key held on the server, and publishes the matching public key in DNS so receivers can verify the signature.
- In cPanel, open Email → Email Deliverability.
- Find your domain in the list.
- If DKIM shows a problem, click Repair. cPanel generates the key pair and installs the DNS record.
- If your DNS is hosted elsewhere, click Manage to reveal the record, and copy it into your external DNS provider exactly as shown.
The record is published at a name like default._domainkey.yourdomain.com. The value is a long string - paste it whole and let the DNS interface handle any splitting.
Step 4 - DMARC
Add a TXT record named _dmarc. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1; pct=100This changes nothing about delivery but starts sending you aggregate reports showing every source sending as your domain - including ones you had forgotten about. Leave it in place for two to four weeks.
Once the reports show only legitimate senders passing, tighten in stages:
| Stage | Policy | Effect on failing mail |
|---|---|---|
| 1 - Monitor | p=none | Delivered as normal; you just get reports. |
| 2 - Quarantine | p=quarantine | Sent to the junk folder. |
| 3 - Reject | p=reject | Refused at the door. Strongest anti-spoofing protection. |
p=reject. If any legitimate sender is missing from SPF or unsigned by DKIM, that mail will be silently rejected - invoices, password resets, order confirmations. Monitor first.
Step 5 - Test it
- Send a message from your domain to a Gmail address you control.
- Open it, click the three dots and choose Show original.
- You want to see PASS beside SPF, DKIM and DMARC. Anything else names the problem directly.
Free mail-testing services also give a scored report and flag issues such as a missing reverse DNS entry or a listed IP address.
Other things that push mail into junk
| Cause | Fix |
|---|---|
| Sending from an address that does not exist | Contact forms often send "from" the visitor's address. Send from your own address and put theirs in Reply-To. |
| Mismatch between envelope and From domain | DMARC requires alignment. Configure your application to send as an address on your own domain. |
| A compromised mailbox sending spam | Change every mail password and open a ticket. Reputation damage from an hour of spam takes weeks to repair. |
| A brand-new domain | No sending history means no reputation. Build volume gradually rather than sending thousands on day one. |
| Bulk mail sent from shared hosting | Use a dedicated transactional or marketing provider for newsletters, and add it to your SPF record. |
| Purchased or scraped mailing lists | Nothing will fix deliverability while spam complaints keep arriving. Send only to people who opted in. |
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| SPF shows "permerror" | Two SPF records published, or more than ten DNS lookups. Merge into one and reduce the includes. |
| DKIM fails after moving DNS | The key record did not come across. Re-copy it from Email Deliverability into the new DNS provider. |
| Mail to one provider only goes to junk | Each provider scores independently. Ask a few recipients there to mark a message as "not junk" - that is a strong positive signal. |
| Forwarded mail fails SPF | Expected: forwarding changes the sending server. DKIM survives forwarding, which is exactly why you need it as well as SPF. |
| Everything passes, mail still junked | Reputation or content. Check whether the sending IP is on a public blocklist, and open a ticket so we can review the mail logs. |
Frequently asked questions
Do I need all three records?
Yes. Major providers increasingly require authenticated mail, and DMARC only works when SPF or DKIM is in place to align against.
Will publishing these break anything?
SPF and DKIM are safe to publish. DMARC is safe at p=none. Only tightening to quarantine or reject can affect delivery, which is why you monitor first.
How long until it takes effect?
DNS changes propagate within hours. Reputation recovery, if your domain has been sending unauthenticated mail for a long time, takes days to weeks.
Can Fast Hive set this up for me?
Yes. cPanel's Email Deliverability tool does most of it in one click, and if you would rather we handled it, open a ticket with Technical Support listing every service that sends mail as your domain.
Where do DMARC reports go, and what do I do with them?
To the address in the rua= tag. They are XML and hard to read raw - free DMARC report analysers turn them into a readable summary.
