cPanel & Plesk: DKIM, SPF & DMARC Setup

cPanel and Plesk both ship with DKIM signing, and both make it easy to assume the job is done. They can generate keys and write DNS records, but only under conditions: cPanel must control the zone, and Plesk only fills in records when the domain uses its DNS. Neither publishes DMARC for you.

This guide covers the current cPanel interface, the older one on budget hosts, and the Plesk equivalent.

What you need

• cPanel or Plesk login for the account that owns the domain.
• Access to the authoritative DNS zone, either through the panel or at an external provider.
• Knowledge of whether mail is hosted locally or relayed through Google Workspace or Microsoft 365.
• A mailbox for reports, if you publish a rua address.

cPanel: start with Email Deliverability

In cPanel 84 and later, open Email then Email Deliverability. Each domain shows a status: Valid means SPF and DKIM match the server's expectation; anything else means a record is missing or wrong.

If the domain uses the host's nameservers, click Repair. cPanel lists the records it will install; review, confirm, then reload. With external DNS such as Cloudflare, Repair is unavailable because the panel cannot write to that zone. Use Manage instead.

cPanel: read the records under Manage

The Manage page has three sections:

• DKIM — shows the expected TXT record at default._domainkey. If no key exists, click Generate Local DKIM Key, then copy name and value. Use Full unless your provider refuses long values; Split breaks the key into 255-character chunks for providers that do not reassemble it.
• SPF — shows the suggested record, typically v=spf1 +a +mx +ip4:203.0.113.10 ~all. +a and +mx authorize this server, which is why a stock record works for local mail. Click Customize to add includes for external senders.
• Reverse DNS — checks that the sending IP's PTR matches the mail hostname. You cannot fix this yourself on shared hosting; open a ticket with the host.

If DNS is external, add the copied records in Zone Editor (when local) or at your provider, then reload.

cPanel: add DMARC by hand

cPanel's deliverability tool centers on SPF and DKIM. Some builds suggest a DMARC record; do not count on it. Add one yourself at _dmarc:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

Older cPanel versions call this Email Authentication, under Email, with simple DKIM and SPF toggles per domain. Those create records locally; confirm they exist in the public zone.

Plesk: enable DKIM signing

DKIM is enabled server-wide first. Go to Tools & Settings, then Mail Server Settings, and in the DKIM section confirm that Allow signing outgoing mail is selected. Then enable it per domain: Websites & Domains, select the domain, open the Mail tab, then Mail Settings, and keep Use DKIM spam protection system to sign outgoing email messages checked.

With Plesk DNS, two records appear automatically: default._domainkey.yourdomain.com with the public key, and _domainkey.yourdomain.com with the DKIM policy. With external DNS, click the How to configure external DNS hint, copy both records, and add them at your provider. Domain aliases need the same records.

SPF and DMARC live in DNS Settings. Plesk's template usually includes v=spf1 +a +mx -all and may include DMARC, but neither is guaranteed on migrated or external zones. Verify rather than assume.

Verify both panels

Send from a mailbox on the server to Gmail and open Show original: you need spf=pass, dkim=pass with your domain in d=, and dmarc=pass. Then check outside with the DKIM Checker using selector default, the SPF Checker, the DMARC Lookup and the TXT Lookup. The Email Health Check summarizes everything in one pass.

Common mistakes

1. Forgetting the host's sending IP on shared hosting. If mail leaves through the provider's relay rather than your IP, add that relay or its include to SPF; +a +mx alone can fail.
2. Assuming Repair worked when DNS is external. cPanel cannot write to a third-party zone, and the status stays invalid until you copy the records manually.
3. Publishing DMARC twice. An old TXT at _dmarc plus a new one produces unpredictable results. There must be exactly one.
4. Sending from PHP without the milter. cPanel notes that DKIM may not verify for PHP-sent mail depending on the handler; route those through authenticated SMTP.
5. Plesk external DNS left unconfigured. The per-domain checkbox can be on while the public zone has no key, so signing happens locally and verification fails remotely.

Frequently asked questions

Does cPanel create the DMARC record automatically?

Not reliably. Recent builds may suggest one, but assume DMARC is manual: add a TXT at _dmarc, starting with p=none.

Why does Email Deliverability say Valid but mail still lands in spam?

Valid only means SPF and DKIM match the server's expectation. Reputation, PTR, content and complaint rates sit outside that check. Run a full deliverability test and confirm the sending IP is not blacklisted.

Can I enable DKIM on Plesk with external DNS?

Yes, but Plesk cannot publish the records. Enable signing per domain, open the external DNS hint, and add both the default._domainkey TXT and the _domainkey policy record at your provider.

Is a 1024-bit DKIM key acceptable on shared hosting?

It is better than no signature, but 2048-bit is the current baseline. If the panel generated a 1024-bit key years ago, regenerate it and republish the TXT record before tightening DMARC.