How to set up SPF, DKIM and DMARC on Namecheap

Everything happens in one place: Domain List → Manage → Advanced DNS → Add new record. SPF is one TXT record on your root domain, DKIM is a TXT record whose value is generated for your mailbox — you copy it, you never invent it — and DMARC is one TXT record named _dmarc. Namecheap is one of the faster registrars here: it states that "normally, it takes 30 minutes for newly created host records to take effect".

These three settings let receiving mail servers check that a message claiming to be from you really is from you. They do not guarantee your email reaches the inbox — your content and your sending reputation matter at least as much — but without them, anyone can send email in your name.

What we don't do: we never touch your DNS zone. This guide tells you what to type and where. You're the one who saves it, in your own account, with your own credentials.

Before anything else: can you even see the Advanced DNS tab?

Namecheap is unusually clear about this, and it's the single most common reason a setup "doesn't work". The Advanced DNS section only manages your records if your domain is actually using Namecheap's own nameservers. In Namecheap's words: "The Host Records section is available only for the domains using Namecheap BasicDNS, FreeDNS or PremiumDNS."

And if you've pointed the domain at Cloudflare, at a web host, or at Namecheap's own hosting nameservers, here's what Namecheap tells you: "If you see no option to manage the DNS records in the Advanced DNS section, your domain is pointed to a third-party nameservers OR our hosting nameservers… Hence, you need to add/update the DNS records at your current DNS provider or in your cPanel."

So: if the section is missing or looks empty, don't hunt for a hidden button. Your DNS lives elsewhere, and that's where these records belong. The values in this guide don't change — only the panel does.

The records to copy and paste

1. SPF — who is allowed to send as you

What you must replace: quite possibly the whole include:. The value above is the one Namecheap publishes for its own mailbox product, Private Email. If your mailboxes are elsewhere, use the value your mail provider gives you:

If several services send on your behalf, they all go in one single line:

v=spf1 include:spf.privateemail.com include:_spf.google.com ~all

⚠️ One SPF record per domain. Always. Two v=spf1 lines don't mean double protection, they mean no SPF at all — not for the new tool, and not for your normal mailboxes either. When you add a sending tool, you edit the line you already have.

Careful with Namecheap's own SPF example. Its generic TXT help article uses v=spf1 a ~all as an illustration. That's a minimal teaching example, not a value to copy: it authorises only the IP address your domain's A record points to, which for most people is a website, not a mail server. Use the include: your mail provider actually gives you.

2. DKIM — the signature on your messages

Namecheap doesn't generate your DKIM key unless you use its own mailboxes. Whoever sends your email does.

If you use Namecheap Private Email:

What you must replace: the value, always — it's generated for your mailbox. And check the host name against your own screen, because Namecheap changed the selector: subscriptions created after 2 June 2026 use privateemail._domainkey, while older ones keep default._domainkey. Two live formats side by side is exactly the kind of detail that makes a tutorial wrong for half its readers, so trust what your account shows you over anything you read — including this page.

To generate the key: sign in to Namecheap, open the Private Email menu, click Manage next to your domain, then the Generate button under DKIM.

On BasicDNS, Namecheap says the record "should be configured automatically". Note the hedge — that's Namecheap's own wording, not ours. Check that the record actually exists in Advanced DNS rather than assuming. On PremiumDNS, on Namecheap hosting, or on third-party nameservers, you add it yourself.

If your email is elsewhere: Google Workspace gives you a single TXT record (selector google by default); Microsoft 365 gives you two CNAME records whose names and values are generated in the Microsoft Defender portal; most campaign tools give you one to three records, TXT or CNAME depending on the tool. Same rule every time: copy what your own screen shows.

⚠️ Never trust a tutorial that hands you a ready-made Microsoft 365 DKIM value. Since May 2025, Microsoft uses a new CNAME format for custom domains added after that date, with a partition character assigned dynamically — it is genuinely impossible to guess.

If your DKIM value is very long: a 2048-bit key runs past 255 characters, and DNS splits long text values into quoted chunks — "first part" "second part". That's not a Namecheap quirk, it's how the DNS protocol works, and the checking server reassembles them. Don't delete the quotes by hand.

3. DMARC — the instruction you give to inboxes

What you must replace: YOU@YOUR-DOMAIN.com with an address you actually read. That's where your reports land, and a DMARC record without a rua= is a report you'll never see.

Why p=none first. It means "watch and tell me". Nobody gets blocked, nothing changes for your recipients, and you start receiving a list of everything sending in your name — including the tools you'd forgotten about. You watch for two to four weeks, confirm every legitimate sender is recognised, and only then tighten one notch to p=quarantine, then p=reject.

⚠️ One DMARC record per domain too. If you already have one, you edit it. You don't add a second.

Namecheap's own DMARC examples are not where you should start, and this is worth two minutes of your attention — see mistake 2 below.

The click path

1. Sign in to Namecheap and open your Domain List.
2. Click Manage next to the domain you want to change.
3. Open the Advanced DNS tab.
4. Click Add new record, and pick TXT Record from the type list.
5. Fill in Host, then Value, then TTL.
6. Click Save all changes.

The Host field wants the prefix only. Namecheap spells it out: enter @ for the root domain, or the prefix on its own — and "the domain name itself should not be included in the Host field." So @ for SPF, _dmarc for DMARC, privateemail._domainkey for DKIM. Never _dmarc.yourdomain.com.

On TTL: Namecheap's default is 30 minutes, and its advice is to "select it from the drop-down or just leave it 'Automatic'". Automatic is fine for all three records here. Worth knowing what that number means: with a TTL of 1800 seconds, "DNS servers around the world can still be showing the old value from their cache for up to 30 minutes after the change."

The 3 mistakes we see most often on Namecheap

1. Editing a zone nobody reads

You add the three records in Advanced DNS, everything saves, and nothing happens — your mail provider never validates, your scan never changes. Almost always, your nameservers point somewhere other than Namecheap BasicDNS, and the records you just saved are sitting in a zone no resolver ever queries.

Namecheap's Advanced DNS makes this harder to notice than it should be, because the section quietly stops being the source of truth rather than telling you so.

How you spot it: your records look right in Namecheap, but any outside lookup of your domain returns something different — or nothing. Check your nameservers first, always.

The fix: add the records wherever your nameservers actually point. Same values, different panel. And from then on, that's your real DNS home.

2. Copying Namecheap's own DMARC example

This one is specific to Namecheap and it catches careful people, because they're doing the sensible thing: following the registrar's own documentation. Namecheap's generic TXT help article illustrates DMARC with:

v=DMARC1;p=reject;sp=quarantine;pct=100;rua=mailto:dmarcreports@example.com

Two problems with pasting that on day one.

It starts at p=reject. That's the strictest possible policy, published before you've seen a single report. Any legitimate sender you've forgotten — your invoicing tool, your website's contact form, your CRM — stops being delivered. Not sent to junk: rejected outright, invisibly.

It uses pct=. That tag was removed from the DMARC standard by RFC 9989, published in May 2026. Servers that follow the new standard ignore it. So pct=100 does nothing, and — more dangerously — a smaller number like pct=5 doesn't protect you either. Don't build a gradual rollout on it.

How you spot it: you published a DMARC record recently, and email that used to arrive has stopped. Check your _dmarc value for p=reject or pct=.

The fix: start at v=DMARC1; p=none; rua=mailto:YOU@YOUR-DOMAIN.com, read your reports for two to four weeks, then tighten in steps. Our full method is linked below.

3. A second SPF record for the new tool

You sign up for a campaign tool, it asks for include:something.com, and you create a new TXT record for it. Now your domain has two v=spf1 lines, and SPF stops working entirely — including for the mailboxes that were fine yesterday.

How you spot it: a scan reports "multiple SPF records", or your DMARC reports show SPF in permerror while each individual line looks fine. Some recipients accept you, others don't, with no obvious pattern.

The fix: one line, all the include: values inside it. Delete the extras — don't leave them "just in case".

⚠️ And while you're in there, don't mix up two opposite traps. Typing the full hostname in Namecheap's Host field creates a duplicated domain (_dmarc.yourdomain.com.yourdomain.com) and the fix is to shorten it. At some other registrars (OVH, Gandi), the symmetrical trap sits on a CNAME target, where the fix is to add a trailing dot. Same look, opposite fixes.

How long before it takes effect

• In your Namecheap account: saved as soon as you click Save all changes.
• On the internet: Namecheap's own figure is "normally, it takes 30 minutes for newly created host records to take effect" — noticeably faster than most registrars.
• DKIM for Private Email: Namecheap states "normally, it takes 60 minutes for the changes to come into effect".
• The old value can stay cached for as long as the TTL you had set before the change — 30 minutes on Namecheap's default.
• For your provider's "Verify" button: wait half an hour before clicking, then wait again. Clicking twelve times in five minutes only adds doubt.
• For DMARC reports: the first ones arrive 24 to 72 hours after you publish, then roughly once a day.

Next steps

• Set up Mailchimp domain authentication on Namecheap
• How to set up SPF, DKIM and DMARC on GoDaddy
• How to set up SPF, DKIM and DMARC on Cloudflare
• How to move your DMARC policy to p=reject safely
• My emails go to spam even though SPF, DKIM and DMARC pass