Email deliverability on cPanel: SPF, DKIM, DMARC, MTA-STS

Since Google and Yahoo turned their 2024 bulk sender rules into outright rejections during 2025, a cPanel server with default mail settings will land most of its outbound mail in spam or get it bounced outright. cPanel handles the easy half — SPF and DKIM — through the Email Deliverability interface, but DMARC, MTA-STS, TLS-RPT, and reverse DNS are still manual work.

This is the end-to-end checklist for a shared cPanel server in 2026, in the order that actually fixes deliverability. If you only do one thing, fix reverse DNS first — it is the single most common reason mail from a cPanel box goes to spam.

1. Reverse DNS and the HELO hostname

Receiving servers do a forward-confirmed reverse DNS lookup on the connecting IP. If the PTR record doesn't exist, doesn't resolve back to the IP, or doesn't match the HELO/EHLO string Exim presents, Gmail and Outlook quietly penalise the message.

Set the PTR record at your provider's control panel (Hetzner, OVH, Vultr, Linode, AWS, DigitalOcean — none of them expose this in cPanel). The PTR must match the hostname Exim uses when it greets remote servers:

# What Exim currently announces
exim -bP primary_hostname

# What the public sees
dig +short -x 198.51.100.42

Both must return the same FQDN — usually your server's main hostname, server1.example.com. If you set up the box following our cPanel install guide this is already correct. If not, fix the PTR upstream and then in WHM go to Server Configuration → Basic WebHost Manager Setup and confirm the hostname matches.

2. SPF — cPanel does this for you

cPanel auto-generates SPF records for every domain it hosts. In WHM, open Service Configuration → Exim Configuration Manager → Basic Editor and confirm SPF Records: Enabled is on. For an individual account, Email Deliverability in cPanel will repair a broken or missing SPF.

The default record looks like this:

v=spf1 +a +mx +ip4:198.51.100.42 ~all

That's correct for a server that sends its own mail. If the domain also sends from SendGrid, Postmark, Mailgun, or Google Workspace, you must merge those into a single SPF record — you cannot publish two:

v=spf1 +a +mx +ip4:198.51.100.42 include:_spf.google.com include:sendgrid.net ~all

Use ~all (softfail) while you're rolling out DMARC and switch to -all (hardfail) only once DMARC reports are clean.

3. DKIM — let cPanel sign, but rotate the key

The same Email Deliverability interface generates a 2048-bit DKIM keypair, publishes the public half as default._domainkey.example.com, and configures Exim to sign outbound mail. For most accounts the green "Valid" badge appears within a minute of repair.

The one thing cPanel doesn't do is rotate keys. Best practice is to rotate at least once a year. The cleanest way is to switch the selector:

# Generate a new selector for an account
uapi --user=USERNAME EmailAuth install_dkim_private_key \
  domain=example.com \
  selector=may2026

Publish the new selector's DNS, wait 48 hours for caches to settle, then remove the old default._domainkey record.

4. DMARC — start at monitor, end at reject

cPanel publishes no DMARC record. You add it as a TXT at _dmarc.example.com. Start in monitor mode for two weeks, read the aggregate reports, then ratchet up.

Week 1-2 (monitoring):

v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1; adkim=r; aspf=r;

Week 3-4 (quarantine):

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com; adkim=r; aspf=r;

Production (reject):

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s;

The rua mailbox will fill with XML reports from every receiver in the world. Pipe them into a parser — Postmark, Valimail, or a self-hosted instance of parsedmarc all work. Without a parser the data is useless.

5. MTA-STS and TLS-RPT — entirely manual

cPanel has no UI for MTA-STS. You publish it as a DNS record plus a static HTTPS file. This is the 2026 equivalent of opportunistic TLS being too weak — Gmail now flags inbound domains without MTA-STS as "no encryption guarantee".

Step 1 — DNS record at _mta-sts.example.com:

v=STSv1; id=20260516000000

The id is an opaque version string. Change it whenever you change the policy file.

Step 2 — policy file served at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: server1.example.com
max_age: 86400

Create the mta-sts subdomain as a parked or addon domain inside cPanel, drop the file in public_html/.well-known/, and make sure AutoSSL has issued a certificate for it. The policy is fetched over HTTPS, so a broken cert defeats the whole exercise.

Step 3 — TLS-RPT record at _smtp._tls.example.com:

v=TLSRPTv1; rua=mailto:tlsrpt@example.com

This gives you a daily JSON report of TLS failures from every sender — invaluable for catching expired certs before customers notice.

6. Testing the whole stack

Don't trust the cPanel UI alone. Send a test message to a checker that returns a detailed report:

# Send one test
echo "deliverability test" | mail -s "test $(date +%s)" \
  check-auth@verifier.port25.com

mail-tester.com and Google's Postmaster Tools give you the picture from the receiver side. A passing setup scores 10/10 on mail-tester and shows "high" IP reputation in Postmaster Tools within a week.

FAQ

Next steps

• If AutoSSL hasn't issued certificates for your mta-sts subdomain, work through the AutoSSL failure decision tree.
• Reviewing licensing for a fleet of mail-heavy servers? See how cPanel license tiers map to account counts.
• For volume questions on dedicated IPs or multi-server licensing, contact sales.