Table of Contents ⬇️

Running a business website in Nigeria requires dependable email communication system. When a customer fills out an inquiry form on your WordPress site, requests an invoice, or orders a product via WooCommerce, your emails need to reach their primary inbox immediately.

Unfortunately, standard WordPress installations handle email poorly right out of the box. The default PHP mail() function sends unauthenticated messages that major email providers like Gmail, Yahoo, and Outlook immediately flag as suspicious. When that happens, your transactional notifications and marketing newsletters end up in the junk folder or bounce outright.

Fixing this problem requires proper email authentication. By creating SPF, DKIM, and DMARC records within your hosting cPanel, you verify domain ownership, protect your brand identity from spoofing, and ensure reliable email deliverability.

Why Email Authentication Matters for WordPress and Email Marketing

Email authentication serves as a digital passport for every message sent on behalf of your domain name. In the past, servers accepted messages based primarily on the stated sender address. Because scammers routinely spoof legitimate domain names to conduct phishing operations, inbox providers now enforce strict verification standards.

When you send business emails or run email marketing campaigns, receiving mail servers inspect your domain’s Domain Name System (DNS) records. They check whether your host server has explicit authorization to transmit mail for you.

Without authentication:

Transactional notifications like order receipts, reset passwords, and booking alerts fail silently.
Email marketing open rates decline because subscribers never see messages routed to spam folders.
Scammers can impersonate your company email address to send fraudulent invoices to your clients.
Your sending domain risks landing on global real-time blacklists (RBLs), hurting future outbound communication.

Configuring your DNS records provides the technical proof necessary to build a positive domain sender reputation.

Understanding the Email Authentication Trio: SPF, DKIM, and DMARC

Before modifying your hosting account, it is helpful to understand how these three security standards function together. Each protocol addresses a distinct vulnerability during email transmission.

Protocol	Full Name	Primary Purpose	Record Type in DNS
SPF	Sender Policy Framework	Specifies which server IP addresses are authorized to send mail from your domain.	TXT
DKIM	DomainKeys Identified Mail	Adds an encrypted digital signature to email headers to verify message integrity.	TXT
DMARC	Domain-based Message Authentication, Reporting & Conformance	Instructs receiving servers what action to take if SPF or DKIM checks fail.	TXT

Sender Policy Framework (SPF)

SPF prevents unauthorized mail servers from sending emails pretending to be your domain. You publish an SPF record as a single TXT string in your DNS zone file. This record contains a public list of every IP address, web host, and third-party delivery provider authorized to send your outbound mail.

DomainKeys Identified Mail (DKIM)

While SPF checks the originating server IP, DKIM protects the email contents. When your server dispatches an email, it generates an encrypted hash using a private key stored on your cPanel server. The recipient server looks up the public key published in your domain’s DNS records to verify that the message was not intercepted or altered in transit.

Domain-based Message Authentication, Reporting & Conformance (DMARC)

DMARC ties SPF and DKIM together. It tells recipient servers how to handle messages that fail SPF or DKIM checks—whether to allow them through, isolate them in a spam folder, or reject them outright. It also provides XML reporting sent to an email address you specify, allowing you to monitor delivery health.

Technical Prerequisites Before Editing cPanel

Before logging into your control panel, prepare your environment to avoid unexpected delivery disruptions:

Access to cPanel: Ensure you have administrator login credentials for your web hosting account.
DNS Control Location: Confirm where your domain’s nameservers point. If your domain uses external nameservers (such as Cloudflare), you must add these records inside that external DNS dashboard instead of cPanel.
List of External Senders: Identify every third-party service that sends mail using your domain. This includes WordPress plugins, transactional services (like Brevo, SendGrid, or Mailgun), and external business suites (like Google Workspace or Microsoft 365).

Step-by-Step Guide: Configuring SPF in cPanel

cPanel provides two ways to configure SPF: the Email Deliverability tool and the Zone Editor. The Email Deliverability interface is the safest starting point for most WordPress site owners.

1. Locate the Email Deliverability Interface

cPanel will display your primary domain alongside any addon domains. Look for the status column next to your domain name:

If it displays Valid, your server has already installed an initial record.
If it displays Problems Exist, you need to install or update the record.

2. Review and Install the Default SPF Record

Click the Manage button next to your domain.

Under the SPF section, cPanel will propose a default TXT value structured like this:

v=spf1 +ip4:192.0.2.1 +a +mx ~all

This syntax breaks down as follows:

v=spf1: Declares the protocol version.
+ip4:192.0.2.1: Authorizes your cPanel server’s specific IP address.
+a: Authorizes the IP address tied to your website’s main domain name.
+mx: Authorizes any mail exchange servers designated in your MX records.
~all: Represents a “SoftFail,” instructing receiving servers to accept but scrutinize mail from unlisted sources.

If you send email exclusively through your local web host, click Install to apply this record.

3. Modifying SPF for Third-Party Email Senders

If your WordPress website relies on an external SMTP relay or third-party email marketing platforms, you must modify your SPF record to include them. An organization must never have more than one SPF TXT record on a single domain. Having multiple SPF records invalidates all of them.

To combine services, edit the value inside Email Deliverability or open the Zone Editor under cPanel’s Domains section. Add an include: parameter for each provider before the final mechanism:

v=spf1 +a +mx +ip4:192.0.2.1 include:_spf.google.com include:sendinblue.com ~all

Save your changes. Your server IP, Google Workspace, and your email marketing provider now share legitimate sending authority.

Step-by-Step Guide: Setting Up DKIM in cPanel

DKIM uses asymmetric cryptographic keys. Setting it up manually can be tricky, but cPanel simplifies this by generating both the private key and the public DNS record automatically.

1. Generate DKIM Keys in cPanel

Return to the Email Deliverability screen in cPanel and click Manage beside your domain. Scroll down to the DKIM section.

If DKIM is inactive, click the Install or Generate Local DKIM Key button. cPanel will produce:

A private key that remains securely locked on your server.
A public key formatted as a DNS TXT record.

2. Verify the DNS Record in Zone Editor

cPanel automatically writes this generated public key to your local DNS zone. To confirm it exists:

Navigate back to the cPanel home screen and click Zone Editor.
Click Manage next to your active domain.
Filter the records by TXT.
Look for a record name matching default._domainkey.yourdomain.com.ng.

The value will look similar to this:

Plaintext

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Y7…IDAQAB

The default portion represents the selector, while the long alphanumeric string following p= is your unique public encryption key.

Step-by-Step Guide: Creating and Implementing a DMARC Record

Unlike SPF and DKIM, cPanel rarely creates a custom DMARC record automatically. You must add this record manually using the cPanel Zone Editor.

1. Open the Zone Editor

In cPanel, navigate to Domains > Zone Editor.
Locate your domain and click Manage.
Click the + Add Record button at the top right of the table.

2. Enter the DMARC Record Values

Fill in the designated fields with these specifications:

Name / Host: _dmarc.yourdomain.com.ng. (Ensure you include the leading underscore. cPanel will automatically append your root domain).
TTL: 3600 or 14400
Default values are fine).
Type: Select TXT from the dropdown menu.
Record / Value: Enter your policy string.

3. Choosing the Right DMARC Policy Stage

Do not enforce a strict blocking policy on day one. A gradual rollout prevents legitimate automated emails from being blocked while you refine your setup.

Stage 1: Monitor Only (Recommended starting point)
v=DMARC1; p=none; rua=mailto:[email protected]; sp=none;

Stage 2: Quarantine (Moves suspicious emails to spam)
v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected];

Stage 3: Reject (Blocks unauthorized emails completely)
v=DMARC1; p=reject; pct=100; rua=mailto:[email protected];

v=DMARC1: Identifies the record as DMARC version 1.

p=none: Instructs recipient mailboxes to deliver mail normally even if it fails authentication, while generating diagnostic reports.

rua=mailto:…: Designates the administrative email address that will receive daily aggregate diagnostic XML reports.

sp=none: Applies the same policy to any subdomains.

Click Save Record to publish your policy.

Connecting Authentication to WordPress: The SMTP Requirement

Adding DNS records in cPanel solves server-level authentication, but WordPress still needs a reliable way to dispatch messages through that authenticated server.

By default, WordPress attempts to send emails using basic web server processes instead of authenticated SMTP credentials. This often causes messages to bypass the DKIM signing keys configured on your mail server.

To fix this connection on your website:

Install an SMTP plugin on your WordPress site (such as FluentSMTP, WP Mail SMTP, or Post SMTP).
Configure the plugin to route through Other SMTP using your cPanel email credentials, or connect it directly to an API-based transactional service like Brevo or Amazon SES.
Set your From Email address to match the exact authenticated domain name (e.g.,
[email protected]).
Enter your outgoing mail host (usually mail.yourdomain.com.ng)
set the encryption port to SSL (Port 465) or TLS (Port 587), and authenticate with your full webmail email address and password.

Routing WordPress through proper SMTP ensures every automated notification gets digitally signed with the DKIM keys you created in cPanel.

Testing and Validating Your DNS Records

DNS updates can take anywhere from a few minutes up to 24 hours to propagate across global recursive resolvers. Once added, verify that your records are published accurately.

Use these free validation tools:

Mail-Tester.com: Send a test email from your WordPress contact form to the unique temporary address provided on Mail-Tester. The tool evaluates your SPF, checks DKIM signature validity, verifies DMARC alignment, and scores your overall spam rating out of 10.
MXToolbox SuperTool: Visit MXToolbox and run tests on your domain using the SPF Record Lookup, DKIM Check (enter selector default), and DMARC Lookup tools. The platform flags formatting errors, excessive DNS lookups, or missing parameters.
Google Admin Toolbox CheckMX: Input your domain name to check whether your DNS matches Google’s recommended sender guidelines for delivering to Gmail accounts.

Frequently Asked Questions

Can I have two SPF records on my domain?

No. RFC specifications prohibit having more than one SPF TXT record on a single domain. If you publish two records, receiving servers will fail both, causing your emails to bounce. Merge all your server IPs and third-party services into a single string using the include: parameter.

What should I do if my cPanel does not have an “Email Deliverability” icon?

Some shared hosting providers hide or disable the Email Deliverability module in cPanel. If this option is missing from your account, open the Zone Editor under the Domains section and manually create standard TXT records for your SPF, DKIM, and DMARC entries.

Why do my WordPress emails still show “via” or “unverified” in Gmail?

This usually occurs when your WordPress contact form plugin sends mail using the web server’s default hostname rather than your custom domain name. Installing an SMTP plugin and authenticating with your domain’s cPanel email account resolves this discrepancy.

How often should I check my DMARC aggregate reports?

During the initial p=none monitoring stage, review your reports weekly. Look for legitimate outbound services (like an off-site billing software or newsletter tool) that you may have forgotten to authorize in your SPF record. Once you confirm all legitimate mail passes authentication, upgrade your policy to p=quarantine or p=reject.

Final Thoughts on Email Deliverability

Configuring SPF, DKIM, and DMARC in cPanel provides the foundation for reliable domain reputation, safeguarding your brand against spoofing while ensuring critical WordPress notifications hit customer inboxes.

If you manage your own hosting, begin by reviewing your cPanel Email Deliverability tab today, set your initial DMARC policy to monitor mode, and run a test transmission through Mail-Tester to confirm your records are aligned. For businesses managing active customer lists or high-volume ecommerce transactions, conducting regular DNS audits ensures your domain remains compliant with evolving global inbox standards.

Take the next step...