Namecheap Private Email SPF and DKIM setup

What you are setting up

Private Email is Namecheap's hosted mailbox product, separate from the cPanel email that comes with Namecheap shared hosting. It receives and sends the everyday mail for people on your domain, so the setup covers MX as well as SPF and DKIM. Unlike most mailbox hosts, DKIM here is a TXT record with a real key you paste, not a CNAME Namecheap manages for you, and Namecheap says the record is mandatory for outgoing mail to work correctly. Which hostname the key lives under depends on when you bought the subscription, which is the detail this page exists for.

Publish SPF and DKIM

If the domain uses Namecheap's own BasicDNS or PremiumDNS, go to your Dashboard, click Manage next to the domain, open the Advanced DNS tab, scroll to Mail Settings, and choose Private Email from the drop-down. Namecheap says the Private Email records you need are then set up automatically; the DKIM TXT and DMARC are listed as separate manual steps in the same article. If the domain's DNS is elsewhere (Cloudflare, your registrar, a hosting company), add every record at that DNS host. Either way, the full set is:

Type:  MX
Host:  @
Value: mx1.privateemail.com   (priority 10)
Value: mx2.privateemail.com   (priority 10)

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:spf.privateemail.com ~all

Type:  TXT     (DKIM)
Host:  privateemail._domainkey   (default._domainkey if bought before June 2, 2026)
Value: v=DKIM1;k=rsa;p=MIIBIjANB...   (from Generate or Show DKIM)

To get the DKIM value, sign in to your Namecheap account, open the Private Email menu, click Manage next to the domain, and click Generate under DKIM. Once it exists, the same spot shows a Show DKIM button. Paste the value without the surrounding quotes or brackets. If your DNS editor limits a TXT string to 255 characters, Namecheap's instruction is to put as much of the value as fits in the first field and the remainder in the second; do not truncate it. Namecheap also lists optional client-autoconfiguration records (mail, autodiscover, and autoconfig CNAMEs to privateemail.com, plus an _autodiscover._tcp SRV on port 443); they help mail apps find the server and have nothing to do with authentication. Allow up to 30 minutes for the records to propagate. If you already have an SPF record for another sender, merge include:spf.privateemail.com into it rather than adding a second one. The step-by-step for the editor itself is in our Namecheap DNS guide.

Add DMARC

Namecheap's own article suggests a monitor-only record with reports sent to postmaster@ your domain. Any mailbox that can receive the reports works; start at p=none and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Namecheap does not document a custom Return-Path or bounce domain for Private Email, so treat DKIM as the signal that carries your alignment and check the header analyzer for whether SPF aligns too before you rely on it.

The Namecheap Private Email gotcha

Two selector names, and a key that may not exist yet. Subscriptions bought before June 2, 2026 sign with the default selector, so the TXT goes at default._domainkey, and Namecheap can only generate the key after at least one mailbox has been created on the plan. Subscriptions bought on or after that date sign with the privateemail selector, the record goes at privateemail._domainkey, and the key is available the moment you order. Publish the key under the wrong host and nothing complains: Namecheap keeps signing with its selector, receivers look up a hostname that is empty, and DKIM fails on every message while the SPF pass hides it. Check which name the Manage page shows you, and use that one.

The Mail Settings shortcut is not the whole job. Choosing Private Email in the Advanced DNS drop-down is convenient, but Namecheap's own article still lists the DKIM TXT as a separate step you take yourself, so a domain set up only through the drop-down sends unsigned. Two other things to check on that page: if the domain ever used Namecheap hosting, look for a leftover cPanel SPF record and merge it, because two v=spf1 records fail SPF outright; and Namecheap's verification note checks the record at privateemail._domainkey.yourdomain.com, the apex, so if your Private Email mailboxes are on a subdomain, publish the records under that subdomain rather than the apex.

Confirm it worked

• Look the key up. Query the TXT at privateemail._domainkey.yourdomain.com (or default._domainkey.yourdomain.com) and confirm the value starts with v=DKIM1 and matches what Show DKIM displays. Our DKIM record checker does this and flags a split or truncated key.
• Send a test and read the headers. Send from a Private Email mailbox, open the message at the other end, and confirm the DKIM signature shows d=yourdomain.com with s=privateemail or s=default, and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Namecheap Private Email should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.