Repairing the SPF record recommended by cPanel Email Deliverability

Inventory every authorised sender, including the hosting server, marketing platform and external mailbox provider. Save the existing DNS record. A suggested cPanel record may cover the hosting server without covering these other services.

1. Open Email Deliverability and choose Manage for the domain. Inspect the SPF recommendation and current status.
2. Confirm where authoritative DNS is hosted. Use the panel’s repair action only when it controls the live zone and the proposed change is appropriate.
3. At an external DNS provider, edit the existing SPF TXT record at the correct name. Combine the required mechanisms into a single v=spf1 policy rather than adding a second competing SPF record.
4. Check each provider’s current instructions and the SPF DNS-lookup limit before publishing a combined policy. Do not authorise broad address ranges merely to remove an error.
5. Allow DNS caches to expire, then send tests through each legitimate service and inspect authentication results in received headers.

SPF permits at most 10 evaluated terms that cause DNS lookups. Terms such as include, a, mx, exists and redirect consume this budget, including relevant terms reached through nested policies. Exceeding it produces permerror. Direct ip4 and ip6 mechanisms and all do not consume that lookup-term budget.

Two visible provider includes can therefore use more than two lookups if their policies include other policies. Assess the complete evaluation path before adding another sender. Remove an unused authorisation only after confirming that no legitimate service still depends on it; do not shorten a policy by deleting required senders.

There should be one applicable SPF policy and the intended sending systems should authenticate as expected. Email Deliverability status can lag DNS updates; compare the live authoritative answer.

If a sender starts failing after the change, restore or correct the omitted authorisation. SPF evaluates the envelope-sender domain and sending IP, so it is not a guarantee that every visible From identity passes DMARC or reaches Inbox.

Add only services you use and trust to send for the domain. Unused authorisations widen access and consume DNS lookups without improving delivery.

• Publishing cPanel DKIM when DNS is hosted elsewhere
• Why does Email Deliverability report a reverse-DNS problem?
• Tracing a missing message with cPanel Track Delivery
• Changing an email mailbox password in cPanel

• cPanel: Email Deliverability In cPanel
• RFC Editor: Rfc7208

• RFC7208 section4.6.4: SPF DNS lookup limits