How to Set Up DMARC, SPF and DKIM on Namecheap

Where Namecheap actually keeps your DNS records

Log in and click Domain List in the left sidebar. Find your domain and click Manage. Along the top you get a row of tabs: Domain, Products, Sharing & Transfer, and Advanced DNS. Your records live under Advanced DNS.

That tab has two parts that matter for email. Host Records is the table where you add TXT records, with an Add New Record button under it. Mail Settings is a separate dropdown further down that controls your MX records, with four choices: No Email Service, Email Forwarding, Private Email, and Custom MX.

Before you type anything, go back to the Domain tab and look at Nameservers. If it is set to Custom DNS, the Host Records table is not your live DNS. Namecheap only serves records you enter here when the domain uses Namecheap BasicDNS, PremiumDNS, or FreeDNS. Point the nameservers at Cloudflare, Google, or a host, and this panel becomes a scratchpad that affects nothing. People lose days to that. Do the work wherever the nameservers point.

The Host field is the trap

Namecheap appends your domain to whatever you type in the Host field. Its own documentation states this directly: the domain name itself should not be included in the Host field.

So for a DMARC record, the Host is four characters. It is _dmarc. It is not _dmarc.yourdomain.com. If you paste the full name, Namecheap publishes _dmarc.yourdomain.com.yourdomain.com. The panel accepts it, shows no error, and the record is invisible to every mail receiver in the world. This is the single most common silent failure on this provider, and it looks identical to success from inside the account.

For a record that belongs on the bare domain, like SPF, the Host is a single @ character. Namecheap treats @ as the domain root. Leaving the field blank is not the same thing.

The three records, with exact values

All three are TXT records. Namecheap has no separate SPF type in the Type dropdown and does not need one. Pick TXT Record for each, leave TTL on Automatic, and click Save All Changes when you are done. Do not wrap the values in quotation marks. Namecheap handles the DNS quoting itself.

Start DMARC at p=none. That publishes the policy and switches on reporting without changing how a single message is delivered. Read the reports for two to four weeks, confirm every legitimate sender is passing, then move to p=quarantine, then p=reject.

One thing changed recently and most record generators have not caught up. In May 2026 the IETF published RFC 9989, 9990 and 9991, replacing the original 2015 DMARC specification. The pct tag has been removed. If a builder hands you pct=100, delete it. The new spec adds a t tag for test mode, an np tag for non-existent subdomains, and a psd tag, and it determines your organizational domain by walking the DNS tree instead of consulting a public suffix list. Your v, p, sp, rua, adkim and aspf tags still mean what they always meant, and adkim and aspf still default to relaxed.

• SPF. Type: TXT Record. Host: @. Value: v=spf1 include:spf.privateemail.com ~all. That include is for Namecheap Private Email. Swap it for include:_spf.google.com or include:spf.protection.outlook.com depending on who actually sends your mail. You get exactly one SPF record per domain. A second one invalidates both.
• DKIM. Type: TXT Record. Host: privateemail._domainkey for Namecheap Private Email, or google._domainkey for Google Workspace. Value: the long v=DKIM1; k=rsa; p=... string your mail provider generated for you.
• DMARC. Type: TXT Record. Host: _dmarc. Value: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

Where the DKIM key actually comes from

DKIM is a cryptographic signature added to outgoing mail. Namecheap hosts the public half of that key as a TXT record. It does not generate the key unless Namecheap is also the thing sending your mail.

If you use Namecheap Private Email, the key is generated in a completely different part of the account from the DNS panel. Click Private Email in the left sidebar, click Manage next to the domain, then click Generate under the DKIM section. A confirmation appears saying DKIM has been generated, along with the host name and the public key. Copy both into Advanced DNS as a TXT record. Namecheap changed the host name on 2 June 2026: subscriptions from that date forward use privateemail._domainkey, and older subscriptions use default._domainkey. Read what your panel shows rather than assuming. Subscriptions bought from that date also no longer need a mailbox created first.

If Google Workspace sends your mail, generate the key in the Google Admin console under Menu, then Apps, then Google Workspace, then Gmail, then Authenticate email. Take the 2048-bit option. The default selector is google, which makes your Namecheap Host google._domainkey.

Namecheap's Value field holds up to 2500 characters. A 2048-bit key is around 400. You do not need to split it into 255-character quoted chunks and you should not try. That advice circulates because cPanel and several other panels cap the field at 255 characters. Namecheap's own nameservers handle the chunking. Paste the whole string in one field.

Share Access: help without handing over your password

Namecheap has a real delegation feature, and it is scoped per domain rather than per account. Nobody helping you needs your login.

Open Manage on the domain, go to the Sharing & Transfer tab, and find the Share Access section. Type the helper's email address or Namecheap username into the New Manager field and click Add. Choose Give Manager Some Permissions and tick only what the work requires. For email authentication that is the Advanced DNS group, which covers managing host records and changing DNS type. Leave transfer and contact permissions unticked. You confirm the grant with your own account password, which never leaves your hands.

A few practical notes. The person you invite needs their own Namecheap account first, and the invitation goes to the email address on that account. The link is live for seven days and must be clicked while they are signed in to the destination account. They can also switch on automatic acceptance under Incoming Invitations in their security settings. You can revoke access at any moment using the Remove control next to their name. Share Access does not cover SSL certificates, does not work on expired domains, and cannot be applied to several domains in one go, so multi-domain clients get one invitation per domain.

This is how we work, and it is worth saying plainly. We never ask for a Namecheap password, a government ID, or a card number. We do not need any of them to do this job.

Namecheap quirks worth knowing before they cost you an afternoon

None of these are bugs exactly. They are just behaviours this panel has that others do not, and each one produces a setup that looks finished but is not.

• Nothing saves until you press Save All Changes. A row you add and then navigate away from is discarded silently.
• The default TTL is 30 minutes, shown as Automatic in the dropdown. Namecheap says new host records normally take about 30 minutes to take effect. That is your realistic wait. The 24 to 48 hour figure you have read applies to nameserver changes, which is a different operation entirely.
• The Host field caps at 60 characters, Value at 2500, and a domain holds up to 800 records. None of these will bite a normal email setup.
• The panel performs no DMARC or SPF syntax checking whatsoever. A missing semicolon, a typo in v=DMARC1, or a second conflicting SPF record all save cleanly and display a perfectly normal green row.
• Switching Mail Settings to Email Forwarding or Private Email rewrites your MX records automatically. Choose your mail service first, then tune SPF, not the other way round.
• PremiumDNS costs a few dollars a year and adds DNSSEC on anycast servers plus an uptime SLA. BasicDNS is free and publishes exactly the same records. For email authentication alone, BasicDNS is fine.

How to check it actually worked

A saved row in Advanced DNS means Namecheap stored what you typed. It says nothing about whether the record is correct or whether any receiver can see it. Query the DNS yourself.

In Windows PowerShell, run Resolve-DnsName -Type TXT _dmarc.yourdomain.com. On macOS or Linux, run dig +short TXT _dmarc.yourdomain.com.

You want exactly one string back, starting with v=DMARC1. If two come back, delete one, because multiple DMARC records make the policy invalid and receivers ignore all of them. If you get nothing at all, the Host field almost certainly has the domain doubled. Confirm it by querying _dmarc.yourdomain.com.yourdomain.com. If your record appears there, you have found the problem.

Then do the test that counts. Send a message from your real mail system to a fresh Gmail address. Open it, choose Show original, and read the SPF, DKIM and DMARC lines. All three should read PASS. A record can resolve perfectly and still fail alignment, and only a live message will tell you that.

Within a day or two your rua address starts receiving gzipped XML files. Those are the aggregate reports. They are close to unreadable by hand once volume picks up, so point that address at a report parser rather than a person's inbox.

An honest note on what Namecheap cannot do

Namecheap publishes DNS records. That is the whole job, it does it reliably, and BasicDNS does it for free. It is not a deliverability product and does not pretend to be.

It will not read your DMARC reports. The rua address collects raw XML from every receiver that handled your mail, and there is no dashboard for it anywhere in the account. You need a separate parser.

It will not tell you a record is wrong, will not flag a duplicate SPF entry, and keeps no per-record change history. If a record disappears, you cannot see who removed it or when. Share Access permissions are the only meaningful control here and they are coarse.

It also cannot fix the underlying problem. Publishing a DMARC record does not authenticate mail sent by an invoicing tool or a newsletter platform you have forgotten about. Move to p=reject before those senders are aligned and you will stop your own mail.

And to repeat the first point, because it is the one that wastes the most time: if your nameservers point somewhere else, nothing in this panel applies at all.

Working with us

Most people can do everything above in about twenty minutes. If that is you, go and do it. The instructions here are complete on purpose, and we would rather you fix it tonight than pay us to. Where we tend to be worth the money is the messy part: finding the eleven separate systems that send mail as your domain, reading three weeks of aggregate reports, and planning the move from p=none through quarantine to reject with a decision for each sender rather than a guess. We work through Share Access with DNS permissions only, so your password stays yours. We are JWC Apps, based in San Diego, and we are happy to take a look.