Configuring SPF And DKIM Records For HostGator Email

Reliable email delivery starts with proving that messages sent from your domain are legitimate. SPF and DKIM records give receiving mail services evidence that HostGator is authorised to send email for your domain and that messages have not been altered in transit.

This matters for Australian businesses of every size, from a Brisbane trades company sending quotes to customers through to a Melbourne consultancy managing newsletters and client correspondence. A missing or incorrect DNS record can send genuine mail to junk folders, create confusing bounce messages, or weaken trust in your business address.

The settings are managed through your domain’s DNS zone and, in many HostGator accounts, through cPanel’s Email Deliverability tool. The exact values depend on how your domain and mailbox are hosted, so copying the records shown in your account is safer than relying on a generic example.

What SPF And DKIM Do

SPF, or Sender Policy Framework, is a DNS text record that lists the servers permitted to send mail for your domain. When a recipient receives a message from you@example.com, its mail system checks the domain’s SPF policy and compares the sending server with the approved list.

A typical SPF record begins with v=spf1 and may include mechanisms such as a, mx, or a HostGator-specific include value. The final qualifier, often ~all or -all, tells receiving servers how to treat mail from unauthorised sources. The correct HostGator value can vary according to the account, server, and other services you use, so the record displayed in cPanel should take priority over examples found elsewhere.

DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to outgoing messages. The sending server uses a private key, while the matching public key is published in DNS under a selector such as default._domainkey. A recipient can then verify that the message was signed by an approved domain and that its important headers and content remain intact.

These systems perform different jobs. SPF checks the sending infrastructure, while DKIM checks a digital signature attached to the message. Setting up both creates a stronger authentication base and prepares your domain for DMARC, which tells recipient systems what to do when authentication checks fail.

Finding The Required HostGator Values

Sign in to your HostGator customer area, open the relevant hosting account, and launch cPanel. The dashboard may also be available through the customer access or cPanel login links provided by your hosting guide. In cPanel, look for Email Deliverability, usually located in the Email section.

Select the domain that sends your email. HostGator will normally show the recommended SPF and DKIM records, together with the current status. A green or passing result indicates that the visible DNS records match what the mail server expects. A warning may mean the records are absent, duplicated, outdated, or controlled somewhere other than HostGator.

If your domain was purchased through a separate registrar, the authoritative DNS may not be in HostGator. This is common when an Australian business keeps a .com.au domain with one provider and web hosting with another. In that situation, cPanel can display the required records, but you must enter them at the provider responsible for the domain’s nameservers.

Before editing anything, copy the existing DNS zone or record values into a secure working note. This makes it easier to restore a previous setting if another service depends on it. Keep that information separate from ordinary password notes; general account security guidance can also help when documenting access to hosting, registrar, and email services.

Check which platforms send mail for your domain. You may use HostGator mailboxes for staff, Google Workspace for office accounts, Microsoft 365 for calendars, and a marketing platform for campaigns. Every legitimate sending service must be represented in your authentication design. Adding a second SPF record is not the answer, because receiving systems generally expect one SPF policy per domain.

Adding Records In The DNS Zone

If HostGator controls your DNS, open cPanel’s Zone Editor, find the domain, and choose the option to manage or add a record. An SPF record is entered as a TXT record at the root of the domain. In most interfaces, the name is shown as the domain itself or as @.

Paste the complete SPF value provided by HostGator into the TXT or record-value field. Do not add quotation marks manually unless the control panel specifically requires them. Save the change, then return to Email Deliverability and use its repair or verification option if available.

DKIM uses a different name. The host portion usually resembles default._domainkey, although the selector may have another name supplied by HostGator. Enter the selector as a TXT record and paste the entire public key into the value field. Long DKIM keys can wrap across lines on screen, but they should remain one continuous DNS value.

Avoid editing a working DKIM key character by character. A missing semicolon, extra space, damaged line break, or incomplete p= value can invalidate the signature. If HostGator supplies a CNAME instead of a TXT record, create the CNAME exactly as shown; some mail systems publish key material through a CNAME rather than placing the public key directly in your zone.

DNS changes are not always visible immediately. Many updates appear within minutes, but cached records can take several hours to refresh, and some changes may take up to 48 hours in unusual cases. During that window, one checker may show the new value while another still sees the old one. This is normal propagation behaviour rather than proof that the record failed.

If you use a DNS security service or a managed provider, make the change in its dashboard instead of creating a second set of records in HostGator. For Australian operators handling customer information under the Privacy Act, limiting administrative access and retaining a clear record of who changed DNS is sensible operational practice.

Checking Authentication And Avoiding Common Errors

Send a test message from a real HostGator mailbox to Gmail or Outlook, then inspect the message headers. Look for spf=pass and dkim=pass. Gmail users can open the message menu and select Show original; other mail services provide a similar source or authentication view.

The visible From address is not enough to prove authentication. A message can appear to come from your domain while failing SPF or DKIM because it was sent through an unapproved platform. Compare the authenticated domain in the headers with your own domain, especially when using aliases, forwarding, or a third-party newsletter system.

A frequent error is creating two separate SPF TXT records. If the domain already has an SPF policy, combine the required mechanisms into that single record rather than adding another v=spf1 entry. SPF also has a limit of ten DNS lookups, so repeatedly adding services can eventually cause a permanent error. HostGator support or the relevant sending provider can help simplify a crowded policy.

Another mistake is leaving old DKIM selectors in place while changing providers. Old selectors are usually harmless, but the active selector must publish the public key that matches the private key used by the current sending server. If a website contact form sends through a different service from your mailbox, authenticate that service separately.

Forwarding can affect SPF because the forwarding server may not be listed in the original policy. DKIM often survives forwarding if message content is not modified, which is one reason both mechanisms are valuable. Mailing lists, signatures, subject changes, and footer additions can still break a DKIM signature.

For extra checking, use a reputable DNS lookup or mail-testing service and review the result from more than one network. Keep a record of the selector, host name, and date of each change in a restricted location. A separate DNS change checklist can be useful for keeping hosting, registrar, and mail records together without relying on memory.

Managing DMARC And Ongoing Delivery

Once SPF and DKIM pass for normal mail, consider publishing a DMARC record. DMARC checks whether the authenticated domain aligns with the address shown to recipients in the From field. It can also send reports showing which services are sending mail that claims to use your domain.

A cautious DMARC policy often begins with monitoring, using a record such as p=none while you review reports. After legitimate services are identified and corrected, an organisation may move towards quarantine or reject. The correct progression depends on how many systems send mail and whether older applications, website forms, or forwarding arrangements still exist.

Australian businesses should pay attention to local email habits and customer expectations. A .com.au address can support credibility with local customers, but it does not automatically authenticate mail. A café in Hobart, a property manager in Perth, or a retailer shipping from Sydney still needs valid records if invoices, booking notices, and support replies are to reach customers consistently.

Review authentication after changing hosting plans, moving DNS, replacing a website form, or adding a bulk-mail provider. Keep an inventory of every approved sender, including CRM systems and accounting platforms used for invoices. This is especially useful for small teams where one person may handle the website while another manages Microsoft 365 or Google Workspace.

Practical Checks Before You Finish

• Confirm that only one SPF record exists for the domain.
• Copy SPF and DKIM values from the current HostGator account rather than an old tutorial.
• Send test messages to more than one major mailbox provider and inspect the headers.
• Record the DNS provider, selector name, date of change, and services authorised to send mail.
• Add DMARC monitoring only after normal HostGator and third-party mail has passed authentication.

Authentication records are small DNS entries, but they influence whether customers see a professional message or an unexplained junk-folder delivery. SPF authorises sending servers, DKIM verifies signed messages, and DMARC adds policy and reporting. The detail to remember is simple: use the exact values supplied for your account, keep one coherent SPF policy, publish the matching DKIM key, and verify the result in real message headers.