How to Add an SPF Record in cPanel

cPanel is the most widely used hosting control panel, and it's where millions of domains manage their DNS records. Adding an SPF record in cPanel is straightforward, but there's one complication you'll almost certainly run into: your hosting provider probably already created an SPF record for you automatically.

This guide covers the full process -- from finding the right DNS tool in cPanel, to dealing with auto-generated records, to building a proper SPF record that works with your hosting server and any third-party email services.

Which Hosting Providers Use cPanel?

If you're on shared or reseller hosting, there's a good chance your host runs cPanel. These are some of the most popular providers that include cPanel:

Finding the DNS Editor in cPanel

cPanel has gone through several interface versions, and the DNS management tool has changed names over the years. Here's how to find it:

Modern cPanel: Zone Editor

In current versions of cPanel, the tool is called Zone Editor. You'll find it under the Domains section of your cPanel dashboard. This is the tool you want.

Older cPanel: DNS Zone Editor or Simple/Advanced DNS Zone Editor

Older cPanel versions split DNS management into a "Simple DNS Zone Editor" and an "Advanced DNS Zone Editor." If you see these, use the Advanced DNS Zone Editor -- it gives you full control over record types and values.

WHM (for VPS/Dedicated Servers)

If you manage your own server with WHM (Web Host Manager), DNS zone management is under DNS Functions > Edit DNS Zone. The process is the same, but you access it from WHM instead of cPanel.

The Auto-Generated SPF Record Problem

Here's the detail that catches most people off guard: many cPanel hosting providers automatically create an SPF record for your domain. This record typically authorizes the server's IP address and sometimes the server's hostname.

A typical auto-generated record looks like:

v=spf1 +a +mx +ip4:192.0.2.1 ~all

This record says: "Allow the server's A record IP, the MX server, and the specific IP 192.0.2.1 to send email." It's fine if your hosting server is your only email sender, but it causes problems when you add third-party services.

How to Check for an Existing SPF Record

Before adding anything, check what's already there:

1. Open the Zone Editor in cPanel
2. Click Manage next to your domain
3. Look for any TXT records with values starting with v=spf1

You can also use SPF Record Check to look up your domain externally and see exactly what SPF record is currently published.

Step-by-Step: Adding or Editing an SPF Record in cPanel

Merging the Auto-Generated Record with Third-Party Services

The most common scenario is needing to combine your hosting server's sending capabilities with a third-party email provider like Google Workspace, Microsoft 365, or a transactional email service.

The key is to keep the server IP from the auto-generated record (if your server still sends email) and add the new provider's include.

Before (auto-generated by host)

v=spf1 +a +mx +ip4:192.0.2.1 ~all

After (merged with Google Workspace)

v=spf1 +a +mx +ip4:192.0.2.1 include:_spf.google.com ~all

Example SPF Records for cPanel Hosting

Here are common configurations for domains hosted on cPanel servers:

cPanel Server Only (No External Email)

If your server handles all email (web hosting email, PHP mail, etc.):

v=spf1 +a +mx ~all

This authorizes the server's A record and MX record. Simple and effective for basic setups.

cPanel Server + Google Workspace

The most common combination -- your website is on a cPanel host, but email is through Google Workspace:

v=spf1 include:_spf.google.com -all

If your site also sends email from the server (contact forms, WordPress notifications via the server's mail function):

v=spf1 +a include:_spf.google.com -all

cPanel Server + Microsoft 365

v=spf1 +a include:spf.protection.outlook.com -all

Include +a only if the server itself also sends email.

cPanel Server + SendGrid

v=spf1 +a +mx include:sendgrid.net -all

Common for sites that use their hosting email for general correspondence and SendGrid for transactional messages.

cPanel Server + Google Workspace + SendGrid

v=spf1 include:_spf.google.com include:sendgrid.net -all

If the server doesn't send email directly (all email goes through Google or SendGrid), you don't need the +a or +mx mechanisms.

cPanel Server + Google Workspace + Mailchimp

v=spf1 +a include:_spf.google.com include:servers.mcsv.net -all

Common cPanel SPF Mistakes

Leaving Two SPF Records Active

This is the number one mistake. You add a new SPF record for Google Workspace without removing or editing the auto-generated one. Now you have two v=spf1 records, and all SPF checks fail with permerror.

Fix: Always edit the existing record. Never add a second one.

Removing the Server IP When You Still Need It

If your WordPress site sends email through PHP mail() (password resets, contact forms, WooCommerce order notifications), removing the server's IP or +a mechanism from your SPF record means those emails will fail SPF.

Fix: Keep +a or the specific ip4: address in your record if the server sends any email at all. Alternatively, configure WordPress to send through an SMTP plugin using Google Workspace or a transactional service -- this is the better long-term approach.

Using the Old DNS Zone Editor Instead of Zone Editor

Older cPanel versions had both a "Simple" and "Advanced" DNS Zone Editor. If you accidentally use the Simple editor, you may not be able to edit TXT record values properly. Always use the Advanced or modern Zone Editor.

Not Checking Propagation

After saving a record in cPanel, it's tempting to assume it's live. But DNS changes need to propagate. Wait a few minutes, then verify with SPF Record Check before calling it done.

SPF for Subdomains in cPanel

If you send email from a subdomain (like shop.yourdomain.com or support.yourdomain.com), add a separate TXT record for that subdomain in the Zone Editor.

Set the Name field to the subdomain (e.g., shop.yourdomain.com.) and the Record value to the SPF record for that subdomain.

Each subdomain gets its own SPF record with its own 10-lookup budget, which is useful when your root domain's record is approaching the limit.

WordPress-Specific Considerations

If your cPanel-hosted site runs WordPress, keep these in mind:

• Default WordPress email uses PHP's mail() function, which sends from the server IP. Your SPF record needs +a or the server's IP to cover this.
• SMTP plugins (like WP Mail SMTP, Post SMTP, or FluentSMTP) send through an external service instead. If you've configured an SMTP plugin to send through Google Workspace or SendGrid, you need that service's SPF include, but you may not need the server IP anymore.
• WooCommerce, form plugins, and membership plugins all send email. Make sure whatever method they use is covered by your SPF record.

Complete Your Email Authentication

SPF is one of three email authentication protocols that work together. Once your SPF record is live in cPanel, the next steps are:

• Set up DKIM -- DKIM adds a cryptographic signature proving your emails haven't been altered in transit. Use DKIM Creator to generate your DKIM keys. Add the resulting TXT record in the same cPanel Zone Editor.
• Set up DMARC -- DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. Use DMARC Creator to build your DMARC policy.

All three records are TXT records added through the same Zone Editor in cPanel.

Monitor Your New SPF Record

You've created your SPF record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.