How to Add SPF and DMARC Records in Namecheap DNS

Adding SPF and DMARC records in Namecheap is a short job once you know two things: where the records go, and which of Namecheap's own mail settings can quietly overwrite them. This guide is registrar-level and works whatever sends your mail — Namecheap Private Email, Google Workspace, Microsoft 365, or a forwarding-only setup. The record values come from your mail provider; the job here is getting them into Namecheap's Advanced DNS correctly.

SPF and DMARC are both published as TXT records. SPF lists which servers are allowed to send mail for your domain. DMARC tells receiving servers what to do when a message fails authentication, and where to send reports. In Namecheap, both live on the Advanced DNS tab of the domain you are configuring.

The short answer#

Open Domain List in your Namecheap account, click Manage next to your domain, and go to the Advanced DNS tab. Under Host Records, click Add new record. For SPF, choose TXT Record, set Host to @, and paste your provider's v=spf1 value. For DMARC, add a second TXT record with Host set to exactly _dmarc and a value that starts with v=DMARC1. Click Save all changes.

Two Namecheap-specific rules cover most of the trouble. The Host field is relative — Namecheap appends your domain for you, so you enter @ or _dmarc, never the full hostname. And the Mail Settings section higher up the same page can inject its own SPF record, which is the conflict most guides skip. More on that below.

Before you start: what you need first#

Namecheap only stores the records. The values are defined by whoever sends your mail, so gather them first from that provider's admin console. Copy them exactly — one wrong character in a value makes the check fail.

• Your SPF value — a single v=spf1 string that names every service that sends as your domain, ending in a qualifier such as ~all (softfail) or -all (fail). For Namecheap Private Email this is v=spf1 include:spf.privateemail.com ~all.
• Your DMARC policy — a v=DMARC1 string with a policy tag (start with p=none) and a rua address to receive aggregate reports.
• Any DKIM record your provider gives you — usually a TXT record at a selector host such as default._domainkey. DMARC only passes when SPF or DKIM aligns, so DKIM is worth adding at the same time.
• Confirmation that the domain uses Namecheap's own nameservers. On the Domain tab, Nameservers must read Namecheap BasicDNS, PremiumDNS or FreeDNS. If it is set to Custom DNS pointing elsewhere, records added here do nothing — add them wherever the nameservers point instead.

How to add the records, step by step#

Work through these in order, and keep your provider's values open in another tab to paste from. Namecheap collects all your edits and applies them when you click Save all changes.

1. 1

   Confirm your nameservers

   On the Domain tab, check the Nameservers section reads Namecheap BasicDNS (or PremiumDNS / FreeDNS). Only then does the Advanced DNS tab control your live records. If the domain points at a web host's or Cloudflare's nameservers, Namecheap's Advanced DNS is ignored — add SPF and DMARC wherever those nameservers point instead.

2. 2

   Add the SPF record (TXT)

   Go to Advanced DNS, then Host Records, and click Add new record. Set Type to TXT Record, Host to @, and paste your SPF value into the Value field — for example v=spf1 include:spf.privateemail.com ~all. Leave TTL on Automatic. Publish only one SPF record: if two services send for you, merge their include: mechanisms into a single string.

3. 3

   Add the DMARC record (TXT)

   Click Add new record again. Type TXT Record, Host exactly _dmarc, and Value v=DMARC1; p=none; rua=mailto:[email protected]. Do not type _dmarc.yourdomain.com — Namecheap adds the domain for you. Starting at p=none collects reports without affecting delivery while you confirm alignment.

4. 4

   Add DKIM if your provider supplies it (TXT)

   This is optional for SPF and DMARC to exist, but DMARC only passes when SPF or DKIM aligns, so most setups want it. Type TXT Record, Host the selector your provider names (such as default._domainkey or privateemail._domainkey), and Value the key string they give you.

5. 5

   Save all changes and verify

   Click the green Save all changes. Namecheap notes records can take up to 30 minutes. Then query TXT for your root domain (SPF) and TXT for _dmarc.yourdomain.com (DMARC) with any public DNS lookup. Each should return exactly what you pasted, with no doubled domain and no stray quotes.

The record fields at a glance#

How your SPF value changes with your mail setup#

The Host and record type never change — SPF is always a TXT record on @. What changes is the value, because SPF names the servers your mail actually leaves from. Use the exact string your provider documents, and re-check it in their admin console before relying on it; these are the common ones.

The forwarding-record trap generic guides skip#

Namecheap's Advanced DNS page has a Mail Settings section that sits apart from your Host Records list. If it is set to Email Forwarding, Namecheap adds the MX records for forwarding automatically and, alongside them, an SPF record the service needs — and the dashboard will not let you delete that SPF record while forwarding is on.

That is where the conflict starts. If you then add your mail provider's own SPF as a new TXT record, your domain publishes two SPF records. Under the SPF standard (RFC 7208) a domain must not have more than one, so receivers return a permanent error and SPF stops working for all your mail — including the provider you were trying to authorize.

There are two clean ways out. If you send through a real provider such as Private Email, Google Workspace or Microsoft 365, set Mail Settings to Custom MX (or the matching preset) so the forwarding records, including that locked SPF, drop away, then publish your one provider SPF. If you genuinely rely on Namecheap forwarding, keep its SPF and fold any other sender into a single merged string rather than adding a second record.

Namecheap's default parking records — a CNAME on www and a URL redirect on @ — are web records, not mail records, so they do not touch SPF or DMARC. Delete them if the domain is unused, but they are not why authentication fails.

What to do when it doesn't work#

Most Namecheap email-record failures trace to a handful of causes, and each has a clean fix. Query the record with a public DNS lookup, compare what returns to what you saved, and the mismatch usually points straight at the cause.

A faster way to catch what still gets through#

These records live in Namecheap's DNS, and publishing and monitoring them is a DNS-and-DMARC job, not something a mail client does. AI Emaily is not a DNS host, a DMARC monitoring service or a deliverability tester — it will not create these records for you, and to read your aggregate DMARC reports you want a dedicated DMARC report tool. For that part of the task, use those.

The adjacent thing we do is on the receiving side. SPF and DMARC are how a receiving server decides whether a message really came from the domain it claims, and AI Emaily reads those same authentication results on the mail arriving in your inbox — so its spam and phishing checks can flag a sender that failed alignment, even when the display name looks right. Connecting a Gmail, Outlook or IMAP mailbox needs no new DNS records, because your outbound still flows through your provider's authenticated servers. We build AI Emaily; it runs on a 7-day free trial on the Pro and Autopilot plans.