Adding DMARC, SPF, and DKIM records in Namecheap

Before you start: which Namecheap DNS are you on?

Namecheap answers DNS three ways, and only two of them use the Advanced DNS panel this guide covers:

• BasicDNS / FreeDNS (dns1.registrar-servers.com, dns2.registrar-servers.com) and PremiumDNS (pdns1 / pdns2.registrar-servers.com) both edit here.
• Namecheap hosting (nameservers ending in namecheaphosting.com) answers DNS from cPanel instead. You would add records under cPanel's Zone Editor, not Advanced DNS.

Confirm which you are on before editing:

dig +short NS yourdomain.com

If the answer ends in registrar-servers.com, follow the steps below. If it ends in namecheaphosting.com or something else entirely, edit there instead.

Step 1: Open Advanced DNS

1. Sign in and open Domain List from the left sidebar.
2. Select Manage next to the domain.
3. Open the Advanced DNS tab. Your records live under the Host Records section.

Step 2: Add the Host Record (and save)

Under Host Records, select Add New Record and choose TXT Record as the Type. The editor has a Host field, a Value field, and a TTL dropdown. Use @ in the Host field for the root domain, and enter only the prefix for everything else. Namecheap is explicit that the domain itself must never go in the Host field.

DMARC

Type:  TXT Record
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
TTL:   Automatic

Start at p=none to watch, then move past p=none once your reports are clean. Our DMARC builder generates the exact value.

SPF

Type:  TXT Record
Host:  @
Value: v=spf1 include:_spf.yourprovider.com ~all
TTL:   Automatic

More than one SPF record at the same host is a permanent error that makes every sender fail SPF, so keep a single v=spf1 record. If one already exists at @, edit it instead of adding another.

DKIM

Type:  TXT Record
Host:  selector._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG... (your full public key)
TTL:   Automatic

Paste the whole public key as a single value. The Advanced DNS panel accepts a long value (up to 2500 characters) in one field, so a 2048-bit or 4096-bit key fits without splitting, and you do not add quotes by hand here.

MTA-STS pointer

Type:  TXT Record
Host:  _mta-sts
Value: v=STSv1; id=20260623000000
TTL:   Automatic

This is only the pointer. The MTA-STS policy itself is a file served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) is the same TXT shape.

Then click Save all changes. This is the step people miss: a new row is not committed until you save, so navigating away first quietly discards it.

Namecheap quirks that bite

• The Email Forwarding SPF trap. On the same Advanced DNS tab, the Mail Settings dropdown has an Email Forwarding option. Turn it on and Namecheap auto-creates MX records and injects an SPF record that it will not let you delete. If you send real mail through Google Workspace, Microsoft 365, or an ESP, set Mail Settings to Custom MX so that forwarding SPF does not fight the record you just published.
• Forgetting Save all changes. No confirmation, no record. Always save before you leave the page.
• The full domain in the Host field. Enter _dmarc, not _dmarc.yourdomain.com. Namecheap appends the domain itself.
• Two SPF records. Consolidate into one v=spf1 record at the apex.

Step 3: Verify it published

New records on Namecheap usually resolve within about half an hour. Check directly:

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. The record is live the moment the lookup returns it; other resolvers catch up as the old TTL expires.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the Namecheap edit resolves. We read the record again from public DNS and refresh the page.