In this article9 sections
Setting up email on a cPanel account takes five minutes. Making that email arrive in the inbox, and not in spam, takes the DNS records that tell receivers your server is allowed to send for your domain. Most email problems on shared hosting come from missing or wrong SPF, DKIM and DMARC records, not from the mailbox itself. This guide creates the mailboxes in cPanel, checks the records that decide delivery, and shows how to test a message before you rely on it.
SiteHarbour’s business email includes spam and virus filtering, and our team sets up SPF, DKIM and DMARC for you. If you run your own mailboxes on a cPanel account, the same records apply, and this guide shows where to find and check them.
Step 1: Create the mailbox
In cPanel, open Email Accounts and select Create. Enter the address, such as [email protected], choose a password from a password manager, and set a quota that fits the account. A quota that is too small makes mail bounce once the mailbox fills, so start with a generous one and watch it.
Expected: the new address appears in the list with its quota. Send a test message from it to a Gmail or Outlook address you control, and confirm it arrives.
Step 2: Check the MX record
The MX record tells other servers where to deliver mail for your domain. It must point at the mail server for the account, not at the website address. Check it from your computer:
dig +short MX example.comExpected: a host name that cPanel’s Email Deliverability page lists as the MX for your domain. If the record points somewhere else, mail goes to the old host and never reaches the mailbox.
Step 3: Publish the SPF record
SPF is a TXT record that lists the servers allowed to send mail for your domain. Without it, receivers treat your mail as suspicious. In Email Deliverability, cPanel shows the SPF record it recommends. Copy that value into your DNS zone, as a single TXT record at the root of the domain. A typical record for mail sent from the account looks like this:
v=spf1 mx a -allUse only one SPF record per domain. Two records make both invalid, and that is one of the most common delivery failures. If you also send through a service such as a newsletter provider, add its include mechanism to the same record, not a second record.
Check the record once it is live:
dig +short TXT example.comExpected: one line that starts with "v=spf1. Two or more lines starting with v=spf1 mean the record must be merged.
Step 4: Turn on DKIM
DKIM signs each message so receivers can confirm it was not changed in transit. In Email Deliverability, select Manage for your domain and enable DKIM. cPanel shows a DNS record for the key. Add that record exactly as shown, including the selector name, and wait for DNS to update.
dig +short TXT default._domainkey.example.comExpected: a long string that starts with v=DKIM1. The selector may be named differently on your account, so use the name cPanel shows. Keep the private key on the server only; you never copy it into DNS.
Step 5: Add a DMARC policy
DMARC tells receivers what to do when SPF or DKIM fails, and it sends you reports. Start with monitoring only, so you can see who sends mail for your domain before you block anything:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Use a mailbox you read for the rua address. Move to p=quarantine and later p=reject only after the reports show that every legitimate sender passes. The full rollout is covered in how to set up DMARC without losing email.
Step 6: Test the whole setup
Send a message to a Gmail address and open the message headers. Look for three results: spf=pass, dkim=pass and dmarc=pass. Those lines confirm the records work together. If one fails, fix that record first. The others depend on the same DNS zone and will not fix each other.
Check the mailbox quota and the outgoing queue on the account in Email Deliverability and Track Delivery. A message that stays in the queue has a reason, shown in the delivery log.
Step 7: Plan for the mailbox to fill
A mailbox fills faster than people expect, especially with attachments. Set a reminder to check usage monthly in Email Accounts. For storage that grows quickly, the cause is often the disk, not the mailbox, which is covered in how to fix disk quota exceeded on cPanel hosting.
Common mistakes
- Two SPF records. Merge them into one. Two records fail the check for every message.
- Publishing DMARC as reject on day one. Legitimate mail from forms, invoices and newsletters can be blocked before you know it exists.
- Using the website’s IP in SPF. The record should list the mail server, not a web address that may change.
- Forgetting the DNS wait. A new record can take time to appear. Check again before you change anything else.
Frequently asked questions
Do I need DKIM if I have SPF?
Yes. SPF checks the sending server, and DKIM checks the message itself. Receivers look at both, and DMARC depends on at least one of them passing with the domain in the address.
Why is my mail going to spam?
The usual reasons are a missing or failing SPF or DKIM record, a sending address that does not match the domain, or a message that looks like a bulk send. Check the headers first, then the records.
Can I send mail from a script on the website?
Yes, but send it through the mailbox account with authentication, not an open relay. Keep the password in configuration outside the web root.
How do I know the records are live?
Use dig or an online checker, and compare the answer with what cPanel shows. DNS changes can take a while to spread, so check again after an hour.
Mailboxes take minutes to create. Good delivery takes three DNS records that agree with each other, and a short test that proves it. Publish one SPF record, turn on DKIM, start DMARC at none, and check the headers of a real message. For a mail relay that sends application email, read how to set up a Postfix relay for application email on Ubuntu.