Protecting your email from spam: SPF, DKIM and DMARC

Keeping your emails out of spam folders

Email providers check whether a message really came from your domain. For that, your domain needs two records: SPF and DKIM. You can check them in cPanel, in Email Deliverability. If there are warnings next to your domain, click “Repair” — the records will be fixed automatically when the domain uses our DNS servers. If your DNS is hosted elsewhere, copy the suggested records into that provider’s control panel.

DMARC — the third record

It tells email providers what to do with messages that fail the checks, and sends you reports. In the DNS editor (DNS records in cPanel) add a TXT record:

Name:  _dmarc.your-domain.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:postmaster@your-domain.com

p=none is monitoring mode: messages are delivered as normal and you receive reports. Once the reports show that all your own mail passes the checks, you can switch to p=quarantine — messages that fake your domain will then go to spam.

Keeping spam out of your inbox

In cPanel, open Spam Filters and turn on processing of incoming mail. Suspicious messages can be put in a separate Spam Box folder or deleted straight away — but only delete them once you are sure the filter isn’t catching mail you want. The lower the threshold in the settings, the stricter the filter. The same page has whitelists and blacklists of senders.

For your own sorting rules, such as “put messages from this address in that folder”, use filters: Email in cPanel.

If spam is being sent from your address

Change the mailbox password straight away and scan your computer with antivirus software. You can see what was sent from the mailbox, and where to, in cPanel under Track Delivery. For how many messages you can send per hour, see Limits on sending email.