DNS help › Namecheap

How to add SPF, DKIM and DMARC records in Namecheap

If your domain is registered with Namecheap and uses Namecheap BasicDNS, PremiumDNS or FreeDNS, you add records on the Advanced DNS tab.

This guide shows where to find your DNS settings, how to add or change a record, and what the main email records do.

Before you start

Namecheap's guide notes that if your domain uses Namecheap Web Hosting DNS, you add records in cPanel instead. If it uses another company's nameservers, add them there.

Step 1: Log in and find your DNS settings

1. Sign in to your Namecheap account.
2. Select Domain List and click Manage next to your domain.
3. Open the Advanced DNS tab and find the Host Records section.

Step 2: Add a TXT record

1. Click Add New Record and choose TXT Record.
2. In Host, enter the host (use @ for the domain itself). Don't include your domain name.
3. In Value, paste the record text.
4. Leave TTL on Automatic.
5. Save your changes.

About the Name field: Enter @ for the domain itself, or just the prefix (for example _dmarc) for anything else. Namecheap adds your domain name for you.

Changing an existing record

To change a record, go back to Advanced DNS, find the TXT record under Host Records, edit its value and save.

Adding a CNAME record

For a CNAME record (Microsoft 365 uses these for DKIM), click Add New Record and choose CNAME Record.

The same steps work for the Tidy Cyber ownership record: Name _tidycyber-verify, with the code we show you when you verify. The code is unique to you and your domain.

Step 3: Understand your email records

These are the records our check looks at. If one already exists, it usually needs editing rather than adding another.

SPF: say who can send email for you

SPF is a single TXT record on your domain that lists the services allowed to send email as you, such as your email provider, newsletter tool or invoicing system. Without it, it's much easier for a scammer to send email that looks like it came from you.

A domain can only have one SPF record, so if you already have one, it needs editing rather than adding a second. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DMARC: tell the world what to do with fakes

DMARC is a TXT record that tells other mail servers what to do with email that fails the SPF and DKIM checks, and can send you reports about who is sending email using your name.

It's best introduced gently: first just watching, then gradually asking receivers to junk and then refuse fake email, once you're sure your genuine email passes. Our free check flags a watch-only policy as a high risk, because fakes are still delivered. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DKIM: sign your emails

DKIM adds a digital signature to the email you send, so receivers can tell it really came from you and wasn't changed on the way. Your email provider creates the key and you publish it in your DNS, as a TXT record or as CNAME records depending on the provider. You can't make up a DKIM value yourself.

In Google Workspace, DKIM lives in the Google Admin console under Gmail's Authenticate email settings. In Microsoft 365, it's on the DKIM tab of the Email authentication settings in the Microsoft Defender portal (see our Microsoft 365 guide). Newsletter tools and booking systems usually have their own DKIM settings. For a CNAME record (Microsoft 365 uses these for DKIM), click Add New Record and choose CNAME Record.

The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

Domains that don't send email

Spare and old domains you never email from can still be used to fake email in your name, so they need locking down too, in a slightly different way from a domain you do use. The full report checks for this and gives the exact records for that domain.

Optional: DNSSEC

DNSSEC adds tamper protection to your DNS records. Our check reports it as a low-priority item. Namecheap offers DNSSEC for domains on its BasicDNS or PremiumDNS; it's on the Advanced DNS tab. Whether it applies to your domain depends on your provider and domain ending; the full report tells you.

Check it worked

Namecheap changes usually take effect within about an hour. Once you think the change has gone through:

1. Go to the free Tidy Cyber check and enter your domain.
2. Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
3. If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.

The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.

Official Namecheap help

We checked these steps against the official guides in October 2026. Screens do change, so if something looks different, follow the provider's own guide:

• How do I add TXT/SPF/DKIM/DMARC records for my domain?
• Managing DNSSEC for domains pointed to Premium or BasicDNS

← All DNS guides