If your branded business emails (like [email protected]) keep ending up in spam, the culprit is almost always the absence or misconfiguration of three DNS records: SPF, DKIM, and DMARC. Setting them up correctly on your hosting provider is the most effective and lasting fix.
Why Email Providers Filter Your Messages
Gmail, Outlook, Yahoo, and other major email providers use sophisticated reputation algorithms. Before delivering a message to the inbox, they check that the sender is who they claim to be. When they can't find the proof they're looking for, the message goes straight to spam.
That "identity proof" is delivered through three records published in your domain's DNS:
- SPF — declares which servers are authorized to send email on behalf of your domain.
- DKIM — cryptographically signs each message so the recipient can verify it wasn't altered in transit.
- DMARC — ties SPF and DKIM together and tells recipients what to do when a message fails verification (ignore, quarantine, or reject).
If any of these records is missing, misspelled, or points to the wrong server, major email providers will penalize you — even if your messages are completely legitimate.
How to Check Whether You Already Have SPF, DKIM, and DMARC
Before touching anything, confirm your current status using these free tools:
- MXToolbox SPF Lookup — search your domain and find out if the record exists and has syntax errors.
- Google Admin Toolbox (
toolbox.googleapps.com/apps/checkmx/) — checks SPF, DKIM, and DMARC all at once. - The
digcommand from any terminal:dig TXT yourdomain.comshows all TXT records, where SPF and DMARC live.
The most common situations you'll find:
- No SPF record exists at all.
- An outdated SPF record that doesn't include your current hosting server.
- DKIM never activated because the key was never generated in the control panel.
- DMARC not configured, so recipients have no instructions on how to handle failures.
Configuring SPF on cPanel (Shared Hosting)
SPF is published as a TXT record in your domain's DNS zone. The basic format is:
v=spf1 include:your-hosting-server.com ~allThe exact include: value depends on your provider. If your hosting uses cPanel, here's how to set it up:
- Log in to cPanel and find the DNS Zone Editor.
- Locate or create a TXT record for your root domain (
@). - Paste the SPF record your provider specifies. It usually looks like
v=spf1 include:hostedmail.example.com ~all. - Save the changes. Propagation takes anywhere from 10 minutes to 48 hours.
Common trap: never have two separate SPF records for the same domain. Spam filters treat that as an error and fail the check. If you already have one, edit it to add the new server with an additional include: instead of creating a second record.
Activating DKIM from the Control Panel
DKIM requires your hosting provider to generate a key pair: the private key signs each outgoing message on the server; the public key is published in your DNS so recipients can download and verify the signature.
In cPanel the process is straightforward:
- Go to Email Authentication.
- Enable DKIM if it isn't already. cPanel will generate the keys automatically and publish the DNS record for you if the domain is hosted on the same server.
- If your DNS is managed externally (Cloudflare, etc.), cPanel will show you the TXT record you need to add manually in that platform.
The resulting record in your DNS will look like this:
default._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."The selector (default) may vary. What matters is that the record exists and the public key matches the private key on the server.
Publishing DMARC: The Record That Ties It All Together
DMARC is a TXT record added as the special subdomain _dmarc.yourdomain.com. A safe starting point for any domain is:
v=DMARC1; p=none; rua=mailto:[email protected]Policy (p=) |
What it does to failing messages | When to use it |
|---|---|---|
none |
Monitor only, no blocking | When starting out; collect data for 2–4 weeks |
quarantine |
Sends failing messages to spam | Once reports confirm all your legitimate senders are passing |
reject |
Fully rejects messages that fail | When you have full control of all your email-sending flows |
The rua field sends daily XML aggregate reports summarizing which servers are sending email under your domain. Analyze those reports before moving to p=quarantine or p=reject — otherwise you risk blocking legitimate emails from systems like CRMs, ERPs, or email marketing platforms.
Other Factors That Affect Email Deliverability
SPF + DKIM + DMARC solve around 80% of corporate email spam problems. But if all three are correct and your messages still land in spam, check these:
- Server IP reputation: on shared hosting you share an IP with hundreds of other sites. If any of them send spam, the entire IP can end up on blacklists. Hosting specialists like the team at elenlace.com can diagnose this and help you migrate to a dedicated IP if needed.
- Message content: words like "free," "limited offer," "click here," or excessive capitalization trigger content filters.
- Text-to-image ratio: emails composed entirely of images have no textual context and are flagged as suspicious.
- Clean recipient lists: sending to many invalid addresses raises your bounce rate and damages your sender reputation.
If you manage your DNS from an external panel like Cloudflare, make sure your domain zone contains the same SPF, DKIM, and DMARC records your hosting provider requires. You can also browse our hosting comparisons to evaluate providers with better IP reputations.
Key Takeaways
- Business email ends up in spam primarily because SPF, DKIM, or DMARC is missing or misconfigured.
- SPF declares authorized sending servers; DKIM cryptographically signs messages; DMARC unifies both and defines the rejection policy.
- Start with
p=nonein DMARC, analyze the reports for a few weeks, then step up toquarantineorreject. - On shared hosting, the shared IP's reputation also matters; consider a dedicated IP if the problem persists.
- Message content, dirty lists, and text-to-image ratio all impact deliverability too.
Still landing in spam after checking all these records? The hosting experts at elenlace.com can run a full DNS and deliverability audit so your messages reach the inbox where they belong.
FAQ
How long does it take to see results after configuring SPF, DKIM, and DMARC?
DNS changes take between 10 minutes and 48 hours to propagate globally. Once propagated, major providers like Gmail and Outlook start verifying the new records immediately. However, if your IP already has accumulated a poor reputation, it can take several weeks of clean sending to rebuild it.
Can I use cPanel email and Google Workspace or Microsoft 365 at the same time?
Yes, but if you use Google Workspace or Microsoft 365 to send email, you must include their servers in your SPF record and activate DKIM through those platforms. Your final SPF record will have multiple include: entries — one for each platform that sends email under your domain.
Why shouldn't I use -all in SPF from the start?
The -all mechanism (hard fail) categorically rejects any server not listed in your SPF. If any legitimate service you use (like a CRM or newsletter platform) isn't included, its emails will be rejected. Start with ~all (soft fail) and only switch to -all once you're certain every sending flow is covered in your SPF.
What should I do if my hosting provider doesn't support DKIM?
Any serious hosting provider should offer DKIM. If yours doesn't, consider migrating to one that does, or use a dedicated email solution like Google Workspace or Zoho Mail, which manage DKIM for you.
Further reading
Other providers and guides worth comparing:
