If a client says "I never got your email" and you find it sitting in their spam folder — or your newsletter is bouncing back from Outlook and Yahoo — the cause is almost never your writing. It's usually three DNS records: SPF, DKIM and DMARC. When these don't line up with how your email is actually sent, mail providers can't confirm the message is really from you, and they either bin it or bounce it. The good news: on cPanel hosting, all three are usually a few clicks away to check and fix.
Why this happens
Every time you send an email, the receiving provider — Gmail, Outlook, Yahoo — runs a background check before it ever reaches an inbox. It asks three questions:
- Is this server actually allowed to send mail for this domain? (SPF)
- Was this message tampered with in transit? (DKIM)
- What should I do if the answer to either of those is "no"? (DMARC)
If your domain's DNS records don't match your actual sending setup — for example, you switched from Gmail to your hosting's mail server, or you use a newsletter tool without updating your SPF record to include it — these checks fail. Gmail is often lenient and will still deliver the mail to spam. Outlook and Yahoo are stricter and more likely to bounce it outright.
A real example: we recently diagnosed exactly this for a client's newsletter platform. Their DKIM signature and Return-Path were signing as one domain, while their actual From address used a different (but similar-looking) domain. Outlook and Yahoo were bouncing every send; Gmail mostly let it through. Once the SPF record was corrected to the right sending IP and the DKIM signing domain and Return-Path were aligned to match the From address, deliverability was confirmed fixed on the next test send.
Before you start
- Access to your cPanel login (via your client area)
- Your domain name (e.g. yourbusiness.co.za)
- Knowledge of which tools send mail on your behalf — your hosting mailbox, plus anything like Mailchimp, ACY Mailing, or a CRM
Checking your SPF and DKIM records
- Log in to your client area, go to My Products & Services, click the green Active button next to your hosting package, then Log in to cPanel.
- Under the Domains section, click Zone Editor, then select your domain.
- Find the TXT record starting with v=spf1 — this is your SPF record. It should list every server or third-party tool allowed to send mail for you.
- Find the TXT record under a name like default._domainkey — this is your DKIM record.
Most cPanel hosting accounts — including SA Webhosts packages — generate SPF and DKIM automatically when your domain is set up. But records can drift out of alignment when you add a third-party sending tool, change providers, or migrate hosting.
Adding a DMARC record
DMARC isn't always set up by default. In the same Zone Editor, add a TXT record at _dmarc.yourdomain.co.za that tells receiving providers what to do if SPF or DKIM fail. Starting with a monitoring-only policy (p=none) is the safest way to introduce it without risking legitimate mail being blocked while you confirm everything else lines up.
Common triggers worth ruling out too
- Sending bulk newsletters from a brand-new domain with no sending history yet
- Using a free Gmail or Yahoo address for business mail instead of your own domain
- A From address domain that doesn't match your actual sending server
- Recipients marking previous emails as spam, which affects your sender reputation over time
Frequently asked questions
Why is my business email going to spam?
Most of the time it comes down to missing or misaligned SPF, DKIM or DMARC records rather than anything wrong with your message content.
What are SPF, DKIM and DMARC?
SPF lists which servers may send mail for your domain. DKIM digitally signs your outgoing mail so it can be verified as untampered. DMARC tells receiving providers what to do if either check fails.
How do I check my SPF and DKIM records in cPanel?
Log in to cPanel, open Zone Editor under Domains, and look for the TXT records described in the steps above.
Why are my emails bouncing specifically from Outlook or Yahoo?
Outlook and Yahoo enforce stricter authentication checks than most providers, so a mismatch between your From address, DKIM signing domain and Return-Path is more likely to cause a hard bounce there than elsewhere.
Not sure where to start, or don't want to touch DNS records yourself? Our support team can check and fix your SPF, DKIM and DMARC setup for you.