SPF, DKIM, and DMARC help receiving mail systems verify messages sent using your domain. They improve authentication, but they do not guarantee inbox placement.
### SPF
SPF lists the servers permitted to send mail for the domain. A domain must not have multiple separate SPF records. If several services send mail, their mechanisms must be combined into one valid record.
### DKIM
DKIM adds a cryptographic signature to outgoing messages. In cPanel, open **Email Deliverability** and check whether the suggested DKIM record is installed. If DNS is hosted elsewhere, copy the exact record to that provider.
### DMARC
DMARC tells receivers what to do when SPF or DKIM alignment fails and can send diagnostic reports. Start with a monitoring policy such as:
v=DMARC1; p=none; rua=mailto:[dmarc-report-address]; adkim=r; aspf=r
Use a dedicated address capable of receiving reports. Review legitimate mail sources before changing the policy to `quarantine` or `reject`.
### Recommended process
1. List every service that sends mail for the domain.
2. Correct SPF and enable DKIM for each legitimate sender.
3. Publish DMARC with `p=none`.
4. Monitor reports and fix unidentified legitimate sources.
5. Gradually enforce a stronger policy when authentication is consistently correct.
### Common mistakes
- Publishing more than one SPF record.
- Copying records from another domain.
- Enforcing DMARC before third-party senders are configured.
- Expecting DNS changes to appear immediately.
**Related articles:** How to Connect a Domain to HillHost; Getting Started with Your HillHost Hosting Account