cPanel Email Deliverability: Fixing SPF, DKIM and PTR
The short answer
In cPanel, open Email Deliverability, find the domain flagged with problems, and click Manage or Repair. Repair rewrites SPF and DKIM to the values cPanel recommends — but only when cPanel controls your DNS. If your DNS or reverse DNS lives elsewhere, cPanel shows the correct values to copy or fix by hand.
cPanel Email Deliverability can fix SPF and DKIM with one Repair click when it controls your DNS — but not a PTR you don't own. Here's what to do.
On this page
cPanel's Email Deliverability interface is the fastest way to see why your mail is failing authentication and, in many cases, to fix it in one click. It checks four things per domain — DKIM, SPF, DMARC and PTR (reverse DNS) — and marks each valid or not. When it can, it offers a Repair button that publishes the records it recommends.
The honest catch, and the reason this guide exists, is that the Repair button only works on records cPanel actually controls. SPF and DKIM live in your DNS zone, so cPanel can rewrite them when it manages your DNS. The PTR record lives with whoever owns your sending IP address — on shared hosting, that is your host, not you. This post walks the interface and is clear about which problems you can fix yourself and which you have to hand off.
The short answer#
Open cPanel, go to the Email section, and click Email Deliverability. Find the domain marked with problems and click Manage to see which record failed, or Repair to let cPanel fix it. Repair reviews the SPF and DKIM records it wants to publish, and on your confirmation writes them to the zone it manages.
Repair is unavailable — greyed out or missing — when cPanel does not control your DNS, for example when your nameservers point at Cloudflare or your registrar. In that case you copy cPanel's suggested values from the Manage screen and add them at your DNS host. A PTR failure is separate again: cPanel flags it, but only the owner of the sending IP can change it.
Before you start#
Three facts about your setup decide what you can do here. Gather them before you touch anything, because they determine whether Repair will even be offered.
- Access to the account in cPanel, or to WHM if you are the server administrator managing every account on the box.
- Who runs your DNS — cPanel's own nameservers, or an external provider like Cloudflare or your registrar. This decides whether the Repair button works at all.
- Whether you control the sending IP address. On shared hosting you do not, so the PTR (reverse DNS) record is your host's to fix, not yours.
- Where your mail is actually sent from. If an outside provider (Google Workspace, Microsoft 365, an email service provider) sends your mail, cPanel's suggested SPF and DKIM are for the local server and will not match your provider's.
If an outside provider sends your mail, ignore cPanel's suggested records
How to fix SPF, DKIM and PTR in cPanel, step by step#
Work through these in order. Read the status before you change anything — the point of the Manage screen is to tell you which record is actually broken, so you are not rewriting a record that was already fine.
- 1
Open Email Deliverability
In cPanel, scroll to the Email section and click Email Deliverability. You'll see every domain on the account with a status. A valid state means SPF and DKIM check out; a 'Problems Exist' flag means at least one of DKIM, SPF, DMARC or PTR failed the check.
- 2
Click Manage to see which record failed
Click Manage next to the flagged domain. cPanel breaks the domain into DKIM, SPF, DMARC and Reverse DNS (PTR) panels and marks each one valid or not, and where relevant it shows the exact value it expects in a copyable box. Read this first so you know which record is broken before you change one.
- 3
Use Repair for SPF and DKIM when cPanel controls your DNS
If cPanel finds a fixable problem and it manages your DNS, a Repair option appears. Click it: cPanel opens a confirmation window listing the SPF and DKIM records it will publish or overwrite. Review them, confirm, and it writes them to the zone. If Repair is greyed out or missing, cPanel does not control your DNS — go to the next step.
- 4
If Repair is unavailable, copy the values into your DNS host
When your nameservers point at Cloudflare, your registrar or another provider, cPanel cannot write the records for you. Open Manage, copy the suggested SPF value (a single v=spf1 string ending in ~all or -all) and the DKIM TXT record (published at default._domainkey by default), and add them at whoever runs your nameservers. cPanel notes you must contact that provider to update the authoritative nameserver.
- 5
Handle the PTR / reverse DNS line honestly
cPanel checks the sending IP's PTR record but usually cannot fix it. Its own docs say you must have authority over the IP to change the PTR, and if you do not, to contact the organization that owns it — your hosting provider, ISP or data center. On shared hosting that means a support ticket. Only set it yourself if you run a VPS or dedicated server with reverse-DNS access.
- 6
Re-check and wait for DNS to propagate
After Repair or a manual edit, cPanel re-runs its checks. Receivers still cache the old answer until the record's TTL expires, so a change that looks applied in cPanel can take minutes to hours to be seen elsewhere. Verify with a public DNS lookup: query TXT for your domain (SPF), default._domainkey (DKIM) and _dmarc (DMARC).
DMARC only goes valid once SPF and DKIM pass
What the Repair button can and can't fix by setup#
The single question that decides everything on this page is: who controls the DNS zone, and who owns the sending IP? The table below maps the common setups to what the Repair button can actually do for you.
| Your setup | Who controls the DNS zone | Repair fixes SPF and DKIM? | PTR fixable by you? |
|---|---|---|---|
| cPanel with local nameservers | cPanel (local) | Yes — Repair writes SPF and DKIM to the zone | No — the IP owner sets the PTR |
| cPanel with external DNS (Cloudflare, registrar) | Your DNS provider | No — Repair is disabled; copy the values across | No — the IP owner sets the PTR |
| Shared hosting, shared IP | Depends — often cPanel local | Yes if cPanel runs the DNS; otherwise copy across | No — open a ticket with your host |
| VPS or dedicated, your own IP | You / cPanel | Yes if cPanel runs the DNS | Yes — set reverse DNS via your host panel or support |
| WHM (server admin, all accounts) | The server, per account | Yes across accounts where the server runs the DNS | Yes for IPs you own; otherwise still the upstream's |
cPanel cannot repair a PTR record you don't own
What to do when it doesn't work#
Most cPanel Email Deliverability failures come from a short list of causes, and each has a clean fix. Work from your symptom: compare what cPanel shows against what a public DNS lookup returns, and the mismatch usually points straight at the cause.
| Symptom | Likely cause | Fix |
|---|---|---|
| The Repair button is greyed out or missing | cPanel does not control your DNS — you use external nameservers | Open Manage, copy the suggested SPF and DKIM values, and add them at your DNS provider. |
| cPanel still says the SPF record has problems after Repair | A second v=spf1 record exists, or a custom SPF overrides cPanel's | Publish exactly one SPF TXT record; merge every include: mechanism into it, ending in a single ~all or -all. |
| SPF fails with a permanent error or 'too many lookups' | The record uses more than 10 DNS-querying mechanisms (RFC 7208 limit) | Cut or flatten include:, a, mx, ptr and exists terms until 10 or fewer remain. |
| cPanel says the DKIM record is not valid | The published key doesn't match cPanel's, or the wrong selector or a truncated value is in DNS | Copy cPanel's default._domainkey value exactly, remove any old or duplicate DKIM record, and re-check. |
| PTR is flagged and Repair won't fix it | The sending IP's reverse DNS is owned by your host or ISP | You cannot change it yourself on shared hosting — open a support ticket with the IP's owner. |
| The record looks correct but receivers still reject the mail | The old value is still cached, or an outside provider sends your mail | Wait for the previous TTL to expire, then re-check — and if an ESP sends your mail, use its records, not cPanel's. |
Where AI Emaily fits — and where it doesn't#
Repairing SPF, DKIM and PTR is DNS and hosting work. It happens in cPanel and at whoever owns your nameservers and sending IP, not in a mail client. AI Emaily is not a DNS host, a deliverability tester, or a reverse-DNS tool, and it will not publish or repair these records for you. For that, cPanel's Email Deliverability interface above is the right place, and a PTR problem is your host's to fix.
The adjacent job we do is on the receiving side. SPF, DKIM and DMARC are how a receiving server decides whether a message truly came from the domain it claims. AI Emaily reads those same authentication results on the mail arriving in your inbox, so its spam and phishing protection can flag a spoofed sender that failed alignment. Connecting a Gmail, Outlook or IMAP mailbox needs no new DNS records. We build AI Emaily, and it comes with a 7-day free trial on the Pro and Autopilot plans.
Frequently asked
See it in AI Emaily
Keep reading
Sources
Written by
Nafiul HasanNafiul Hasan is an entrepreneur and AI automation system builder with 10+ years of experience turning messy, manual workflows into reliable automated systems. He designs and ships AI enterprise solutions end-to-end — the agent logic, the data plumbing, and the product people actually use — and founded AI Emaily to give busy professionals their attention back. He writes here from the builder's seat: what works, what breaks, and how to put AI to work without giving up control.