Manage Email Deliverability in cPanel

Optimize your email deliverability under cPanel. Learn how to automatically repair or manually configure SPF, DKIM, and DMARC records.

Last updated: July 2026

In short: The cPanel "Email Deliverability" interface allows you to resolve SPF, DKIM, and DMARC authentication issues. The system provides an automatic repair feature for locally managed DNS zones. If you use external nameservers, you can copy the recommended records and add them manually to your DNS provider.

If mail server scanners like Kuveris report issues with your domain's email authentication records, you can easily resolve them using the cPanel interface.

Purpose of the Email Deliverability Interface

cPanel provides a dedicated interface to diagnose and fix email configuration errors: Use this interface to identify problems with your mail-related DNS records for one or more of your domains. The system uses these records to verify that other servers can trust it as a sender.

If this interface is missing from your cPanel dashboard, your hosting provider may have disabled it: For the Email Deliverability interface to appear, your hosting provider must enable Email Deliverability in WHM’s Feature Manager interface

Exception: Third-Party Email Services

If you host your website under cPanel but route your email traffic through an external cloud provider (such as Google Workspace or Microsoft 365), do not use cPanel to manage these settings: refer to their documentation for instructions on configuring DKIM and SPF.

Instead, follow the setup documentation provided by your third-party email service.

Automatic Repair (Repair)

If cPanel controls your domain's DNS records, you can use the automatic repair feature: This feature allows the system to repair a domain’s invalid records. A window appears in the interface that allows you to review and confirm the system’s recommendations for any invalid records. You can copy or customize a suggested record before you approve the system’s repairs. The system will recheck any repaired records. This process can take up to five minutes, depending on the server.

If this option is disabled or unavailable, it means cPanel does not control the authoritative DNS zone for your domain: This option is unavailable if the system does not control the domain’s DNS records.

In this case, your DNS records are hosted externally (for example, with your domain registrar).

Manual Management (Manage)

To resolve issues manually or retrieve the record values for an external DNS provider, use the manage tool: Click the Manage option to manually resolve issues with your domain’s mail-related DNS records. A new interface will appear.

1. DKIM Configuration

To correctly configure DKIM, cPanel notes the following nameserver requirement: To correctly install a DKIM record, your server must be the authoritative nameserver. If it is not, you can locally install this record. You must also contact your nameserver provider to update the authoritative nameserver.

If no DKIM record exists for your domain, you can generate one: Generate a DKIM record, if one does not exist.

If your domain's DNS is hosted elsewhere, copy cPanel's suggested record name and value and apply them to your external nameserver: You can provide these records to the nameserver provider for the listed nameservers to fix it.

2. SPF Configuration

If your current SPF record is missing or invalid, cPanel suggests a correct configuration: If any problems exist with the current record, a correct SPF record configuration will appear in the Suggested “SPF” (TXT) Record section.

You can customize the allowed senders list by adding IP ranges, such as the IPv4 network 10.0.0.0/8 or the IPv6 network 2001:db8:1a34:56cf::/64. By default, cPanel recommends a softfail policy: By default, the system recommends the ~all entry. This entry instructs servers to accept mail from unmatched hosts, but warn that unauthorized hosts might have sent the messages.

The ~all suffix tells receiving mail servers to accept mail from unmatched hosts but flag the messages as potentially unauthorized.

3. DMARC Configuration

A DMARC policy requires valid SPF and DKIM records to function properly: DMARC requires valid SPF and DKIM records. The domain must have valid SPF and DKIM records for the DMARC record to be active.

If cPanel is the authoritative nameserver for your domain, you can install the suggested DMARC record with a single click: If your server is an authoritative nameserver for your domain, click Install the Suggested Record to install the DMARC record on your domain.

Otherwise, copy the suggested DMARC record and publish it manually as a TXT record with your external nameserver provider.

Expired or Unmanaged Domains

The Email Deliverability interface displays all domains configured on the server, regardless of their active status: If a domain expires or you stop managing it, but its DNS zone remains on the server, that domain continues to appear in this interface even though you no longer use it.

Verifying Your Setup

After repairing your configuration or copying the records to your external DNS provider, send a test email. Use the free Kuveris scanner to verify that your SPF, DKIM, and DMARC records are successfully published and validated by recipient servers.