A practical, copy-paste guide for hybrid setups where users send email via Google Workspace and websites/scripts send via cPanel.
SPF Authorizes which IPs/servers can send for your domain.
DKIM Cryptographic signature proving message integrity & domain identity.
DMARC Policy + reporting layer that ties SPF/DKIM to the visible From: domain.
DMARC passes if either SPF or DKIM passes and the authenticated domain aligns with the visible From domain.
We recommend strict alignment for strongest protection.
What to publish: an SPF TXT record at the root (host @).
| Directive | Meaning | Why |
|---|---|---|
include:_spf.google.com |
Authorizes Google Workspace MTAs | Required for user mail sent via Gmail/Google |
ip4:XX.XX.XX.XX |
Authorizes your cPanel IPv4 | Required for PHP/Exim mail from your webserver |
ip6:YYYY:...:ZZZZ |
(optional) Authorizes your cPanel IPv6 | Add if mail can originate via IPv6 |
-all |
Hard fail for everyone else | Prevents spoofing from unauthorized IPs |
include:s or nested providers.Publish a TXT record per sender system. Each uses a unique selector (the label before ._domainkey).
google, 2048-bitgoogle._domainkey.yourdomain.tld → v=DKIM1; k=rsa; p=…default._domainkey.yourdomain.tld → v=DKIM1; k=rsa; p=…d= domain matches your visible From domain for DMARC alignmentPublish a TXT record at _dmarc.yourdomain.tld.
| Tag | Options | Recommendation | Why / When not chosen |
|---|---|---|---|
p |
none / quarantine / reject |
Start: none → then quarantine → reject |
Jumping straight to reject can block legitimate mail during setup |
sp |
same as p |
none initially; later reject |
Controls subdomains; enforce once you’re confident |
adkim |
r (relaxed) / s (strict) |
s (strict) |
Relaxed allows subdomain wiggle; strict is cleaner and safer |
aspf |
r / s |
s |
Strict alignment reduces spoofing |
rua |
mailto:… |
Enable | Daily aggregate XML reports show all sources |
ruf |
mailto:… |
Optional | Forensic samples may be verbose; enable for debugging only |
fo |
0, 1, d, s |
1 |
Report on any SPF/DKIM failure for better visibility |
pct |
0–100 | Usually omit | Use only when gradually applying enforcement |
p=none, collect reports for 2–3 weeksp=quarantine, consider sp=rejectp=reject (and sp=reject) once all legitimate sources alignv=spf1 include:_spf.google.com ip4:XX.XX.XX.XX -all
If you also send via IPv6:
v=spf1 include:_spf.google.com ip4:XX.XX.XX.XX ip6:YYYY:YYYY::ZZZZ -all| Host | Type | Value |
|---|---|---|
google._domainkey.yourdomain.tld |
TXT | v=DKIM1; k=rsa; p=<Google 2048-bit public key> |
| Host | Type | Value |
|---|---|---|
default._domainkey.yourdomain.tld |
TXT | v=DKIM1; k=rsa; p=<cPanel 2048-bit public key> |
Phase 1 – Monitor
v=DMARC1; p=none; sp=none; adkim=s; aspf=s; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1;
Phase 2 – Quarantine
v=DMARC1; p=quarantine; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]; fo=1;
Phase 3 – Reject
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]; fo=1;| Record | Host / Name | Type | Value |
|---|---|---|---|
| SPF | @ | TXT | v=spf1 include:_spf.google.com ip4:XX.XX.XX.XX -all |
| DKIM (Google) | google._domainkey |
TXT | v=DKIM1; k=rsa; p=… |
| DKIM (cPanel) | default._domainkey |
TXT | v=DKIM1; k=rsa; p=… |
| DMARC | _dmarc |
TXT | v=DMARC1; p=none; … |
@ 3600 IN TXT "v=spf1 include:_spf.google.com ip4:XX.XX.XX.XX -all"
google._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=<GooglePublicKey>"
default._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=<cPanelPublicKey>"
_dmarc 3600 IN TXT "v=DMARC1; p=none; sp=none; adkim=s; aspf=s; rua=mailto:[email protected]; fo=1;"Aggregate rua reports arrive daily in XML. Parse with:
p=reject. Monitor first, then enforce once all legitimate sources align.For SPF: the domain in the MAIL FROM / Return-Path must match (strict) the visible From domain. For DKIM: the d= domain in the signature must match the visible From domain. We recommend aspf=s and adkim=s for clarity and security.
ruf (forensic) reporting?Optional. It can be noisy and include message samples. Use when actively debugging failures, then remove or keep limited.
Forwarding often breaks SPF but DKIM still passes if signatures survive, so DMARC can still pass. That’s why enabling DKIM everywhere is crucial.
Support: If you’re an IndicHosts.net client, raise a ticket and we’ll verify your DNS, DKIM, and DMARC reports and recommend the right enforcement level for your domain.