Namecheap Private Email SPF and DKIM setup

What you are setting up

Private Email is Namecheap's hosted mailbox product, separate from the cPanel email that comes with Namecheap shared hosting. It receives and sends the everyday mail for people on your domain, so the setup covers MX as well as SPF and DKIM. Unlike most mailbox hosts, DKIM here is a TXT record with a real key you paste, not a CNAME Namecheap manages for you, and Namecheap says the record is mandatory for outgoing mail to work correctly. Which hostname the key lives under depends on when you bought the subscription, which is the detail this page exists for.

Publish SPF and DKIM

If the domain uses Namecheap's own BasicDNS or PremiumDNS, go to your Dashboard, click Manage next to the domain, open the Advanced DNS tab, scroll to Mail Settings, and choose Private Email from the drop-down. Namecheap says the Private Email records you need are then set up automatically; the DKIM TXT and DMARC are listed as separate manual steps in the same article. If the domain's DNS is elsewhere (Cloudflare, your registrar, a hosting company), add every record at that DNS host. Either way, the full set is:

Type:  MX
Host:  @
Value: mx1.privateemail.com   (priority 10)
Value: mx2.privateemail.com   (priority 10)

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:spf.privateemail.com ~all

Type:  TXT     (DKIM)
Host:  privateemail._domainkey   (default._domainkey if bought before June 2, 2026)
Value: v=DKIM1;k=rsa;p=MIIBIjANB...   (from Generate or Show DKIM)

To get the DKIM value, sign in to your Namecheap account, open the Private Email menu, click Manage next to the domain, and click Generate under DKIM. Once it exists, the same spot shows a Show DKIM button. Paste the value without the surrounding quotes or brackets. If your DNS editor splits a long TXT value into two fields, Namecheap's instruction is to put as much of the value as fits in the first field and the remainder in the second; do not truncate it. Namecheap also lists optional client-autoconfiguration records (mail, autodiscover, and autoconfig CNAMEs to privateemail.com, plus an _autodiscover._tcp SRV on port 443); they help mail apps find the server and have nothing to do with authentication. Allow up to 30 minutes for the records to propagate. If you already have an SPF record for another sender, merge include:spf.privateemail.com into it rather than adding a second one. The step-by-step for the editor itself is in our Namecheap DNS guide.

Add DMARC

Namecheap's own article suggests a monitor-only record with reports sent to postmaster@ your domain. Any mailbox that can receive the reports works; start at p=none and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Namecheap does not document a custom Return-Path or bounce domain for Private Email, so treat DKIM as the signal that carries your alignment and check the header analyzer for whether SPF aligns too before you rely on it.

The Namecheap Private Email gotcha

Two selector names, and a key you have to generate. Subscriptions bought before June 2, 2026 sign with the default selector, so the TXT goes at default._domainkey. Subscriptions bought on or after that date sign with the privateemail selector, the record goes at privateemail._domainkey, and Namecheap says the key is available the moment you order. Publish the key under the wrong host and nothing complains: Namecheap keeps signing with its selector, receivers look up a hostname that is empty, and DKIM fails on every message while the SPF pass hides it. Check which name the Manage page shows you, and use that one.

The Mail Settings shortcut is not the whole job on every DNS. Choosing Private Email in the Advanced DNS drop-down sets up MX and SPF, but the DKIM key still has to be generated, and only BasicDNS publishes it for you once it exists. On PremiumDNS, on cPanel hosting DNS, or at a third-party host you add the TXT yourself, so a domain set up only through the drop-down there sends unsigned. Two other things to check on that page: if the domain ever used Namecheap hosting, look for a leftover cPanel SPF record and merge it, because two v=spf1 records fail SPF outright; and Namecheap's own check looks for the record at privateemail._domainkey on the domain you ordered Private Email for, so publish it under that exact domain.

Confirm it worked

• Look the key up. Query the TXT at privateemail._domainkey.yourdomain.com (or default._domainkey.yourdomain.com) and confirm the value starts with v=DKIM1 and matches what Show DKIM displays. Our DKIM record checker does this and flags a split or truncated key.
• Send a test and read the headers. Send from a Private Email mailbox, open the message at the other end, and confirm the DKIM signature shows d=yourdomain.com with s=privateemail or s=default, and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Namecheap Private Email should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.