Mail authentication helps receivers assess whether a message is authorised for your domain. It does not guarantee inbox placement; reputation, content and recipient policy also matter.
Investigate the sending path
- List the services that send for the domain: mailboxes, website forms, newsletters and transactional providers.
- Open Email Deliverability and inspect the domain’s reported records.
- Confirm where authoritative DNS is hosted. A suggested repair in cPanel may need to be applied elsewhere.
- Coordinate SPF and DKIM values with every legitimate sender. Do not publish multiple competing SPF policies.
- Introduce DMARC using a considered policy and review legitimate traffic before enforcing rejection.
- Send a non-sensitive test and inspect authentication results at the receiver.
Keep evidence useful
Save the timestamp, sending service and redacted rejection message. Forwarding can complicate SPF results, so distinguish the original sender from the forwarding server. Reverse DNS is generally managed by the IP-address owner, not fixed by inventing a TXT record.
Never paste a private signing key into public DNS. Do not remove another service’s authentication records without checking ownership. When a record is wrong, fix the specific issue and retest rather than repeatedly changing the whole mail setup.
Official references
Reviewed 2026-10-22. Menus and availability depend on your hosting plan and server configuration.