Editing DNS records in Namecheap

Step 1 - Find the Advanced DNS editor

1. Log in to namecheap.com and click Domain List in the left sidebar.
2. Find your domain in the list and click the Manage button on its row.
3. Across the top of the management page, click the Advanced DNS tab. You'll see the "Host Records" table.

Step 2 - Add the record

1. Click Add new record at the bottom of the Host Records table.
2. Fill the fields per the fix type below. Critical Namecheap rule: in the Host field, never include the domain itself - just the prefix. Use @ for the apex.

DMARC

• Type: TXT Record
• Host: _dmarc
• Value: paste the record exactly as trustyourinbox suggested, e.g. v=DMARC1; p=quarantine; pct=100; rua=mailto:<your-rua>@rua.trustyourinbox.com
• TTL: Automatic (default) is fine. For faster rollback during testing, switch to 5 min.

SPF

• Type: TXT Record (Namecheap uses the same TXT type for all SPF / DKIM / DMARC records - no special "SPF" record type)
• Host: @
• Value: v=spf1 …mechanisms… ~all
• Critical: only ONE v=spf1 record per apex. If the Host Records table already has a TXT row at Host @ starting with v=spf1, click the pencil icon on that row and edit the existing record - don't add a second.

DKIM

• Type: TXT Record
• Host: the selector + ._domainkey (e.g., google._domainkey, k1._domainkey, mta1._domainkey)
• Value: paste the public-key string from your ESP, including the v=DKIM1; k=rsa; p=… prefix.
• RSA-2048 keys are ~390 chars and fit in Namecheap's Value field without segmentation. Namecheap handles long TXT values automatically.

MTA-STS DNS pointer

• Type: TXT Record
• Host: _mta-sts
• Value: v=STSv1; id=<numeric-id>
• The actual MTA-STS policy is a separate .well-known/mta-sts.txt file served over HTTPS at mta-sts.<your-domain>. trustyourinbox can host the policy file for you (separate setup).

Step 3 - Save all changes

Click the green checkmark to confirm the row, then click Save all changesat the bottom of the table. Namecheap announces "30 minutes for newly created host records to take effect" - that's their internal propagation to the FreeDNS/PremiumDNS servers. Receivers honor the existing TTL on the record they last cached, so apparent rollout to receivers can be longer.

Step 4 - Verify the record published

From a terminal, run:

• DMARC - dig +short TXT _dmarc.yourdomain.com
• SPF - dig +short TXT yourdomain.com | grep spf1
• DKIM - dig +short TXT <selector>._domainkey.yourdomain.com
• MTA-STS pointer - dig +short TXT _mta-sts.yourdomain.com

Or paste the hostname into https://dns.google/query?type=TXT&name=<hostname> for a browser-based check.

Step 5 - Tell trustyourinbox to recheck

Each per-domain protocol tab has a Recheckbutton at the top of the "Current record" section. Click it after the Namecheap edit propagates; we run a fresh DoH lookup against Cloudflare 1.1.1.1 and Google 8.8.8.8 in parallel and update the dashboard immediately.

Common Namecheap pitfalls

1. Putting the full domain in the Host field. Namecheap auto-appends your domain. If you type _dmarc.yourdomain.com in Host, the record ends up at _dmarc.yourdomain.com.yourdomain.com - wrong. Just type _dmarc.
2. Forgetting that @ means apex. Some panels accept blank for apex; Namecheap requires @ explicitly. Leaving Host blank usually creates a record at the wrong name.
3. Adding a second SPF record. RFC 7208 §3.2 violation - receivers permerror on multiple v=spf1 records, every authorized sender stops aligning. Always edit the existing apex TXT row.
4. Not clicking "Save all changes".The green checkmark on the row only confirms the row locally. The Save button at the bottom is what writes to Namecheap's nameservers. If you navigate away first, the change is lost.

If you get stuck

Open the per-domain page in trustyourinbox, click Recheck, and if the dashboard still shows the issue, paste the dig +short TXT <hostname>output into a support email. We'll narrow down the difference between what we expected and what Namecheap published.