To set up SPF, DKIM, and DMARC on a Namecheap domain, open the domain in your Namecheap account, go to the Advanced DNS tab, and add each record under the Host Records section: one TXT record for SPF, one TXT or CNAME record for DKIM (depending on your email provider), and one TXT record for DMARC on the _dmarc host. The whole job takes about ten minutes, and the only real traps are the Host field and the exact text of each value.
This guide walks the Advanced DNS screen field by field, explains why Namecheap's Host column trips people up, and shows you how to confirm the records are live before you rely on them.
Reads public DNS only. Nothing is stored unless you save the domain to an account.
Before you start: which DNS is your domain actually using
Namecheap only shows editable Host Records on the Advanced DNS tab when the domain is using Namecheap's own nameservers. That means BasicDNS, PremiumDNS, or FreeDNS must be selected under Domain > Nameservers. If you see "Custom DNS" with someone else's nameservers listed (for example Cloudflare, your web host, or your registrar's parking service), then Namecheap is not answering DNS queries for your domain and any record you add on this tab does nothing.
Check this first. Open the domain, look at the Nameservers section on the Domain tab, and confirm it reads Namecheap BasicDNS or PremiumDNS. If it points somewhere else, that other provider is your real DNS host and you should add the records there instead. Not sure? Our guide on how to find your DNS host shows you how to trace it in under a minute.
Everything below assumes you are on Namecheap DNS and looking at the Advanced DNS tab.
The Host field: @ versus blank, and why it matters
This is the single biggest source of confusion on Namecheap. The Host column is where you tell Namecheap which name the record belongs to. Namecheap uses shorthand:
@means the root of your domain, for exampleexample.comitself. Use@for your SPF record and for most DKIM TXT records that live at the apex.- A label like
_dmarcmeans the subdomain_dmarc.example.com. Namecheap automatically appends your domain, so you type only the label, never the full name. - A DKIM selector like
s1._domainkeymeanss1._domainkey.example.com. Again, type only the label.
Do not type your full domain into the Host field. If you enter example.com as the host, Namecheap treats it as example.com.example.com and the record will not resolve. And do not leave the Host field blank hoping it defaults to the root. Use @ explicitly for the apex. When in doubt, remember that whatever you type in Host gets your domain glued to the end of it, with @ being the one exception that means "nothing extra."
Step 1: Add your SPF record
SPF is a single TXT record at the root of your domain that lists which servers are allowed to send mail as you. You publish exactly one SPF record per domain. If you already have one, edit it rather than adding a second, because two SPF records is a permanent error (PermError) under RFC 7208.
On the Advanced DNS tab, under Host Records, click Add New Record and choose TXT Record:
- Type: TXT Record
- Host:
@ - Value:
v=spf1 include:_spf.google.com ~all - TTL: Automatic
Replace the include: with whatever your email provider tells you to use. Google Workspace uses include:_spf.google.com, Microsoft 365 uses include:spf.protection.outlook.com, and services like SendGrid or Mailgun give you their own include. If you send through more than one service, chain the includes inside the same record:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
End with ~all (softfail) or -all (hardfail). Avoid +all, which authorizes the entire internet to send as you and is genuinely dangerous. One more limit to respect: SPF is capped at 10 DNS lookups, and stacking includes blows past it fast. If you hit that ceiling, our guide on fixing too many SPF DNS lookups walks through flattening it.
Do not wrap the value in quotes yourself. Namecheap's editor handles the quoting for a TXT record automatically, and adding your own " marks can double them up.
Step 2: Add DKIM (CNAME or TXT depends on your provider)
DKIM is where Namecheap's Host rules earn their keep, because the record type varies by sender. Your email provider generates a DKIM key and tells you to publish it under a selector. The selector is the label in front of ._domainkey. There are two common shapes.
DKIM as a CNAME (Amazon SES, many ESPs)
Some providers, including Amazon SES and a number of marketing platforms, host the actual DKIM key on their side and ask you to point a CNAME at it. This is convenient because they can rotate the key without you touching DNS again. It looks like this:
- Type: CNAME Record
- Host:
abc123._domainkey - Value:
abc123.dkim.amazonses.com - TTL: Automatic
You publish the selector label in Host and the provider's target in Value. You often get three of these for SES. Why a CNAME and not a TXT? Because the key material stays with the provider. Our explainer on DKIM CNAME versus TXT covers the tradeoff in depth.
DKIM as a TXT (Google Workspace, Microsoft 365, Zoho)
Other providers hand you the full public key and ask you to paste it into a TXT record. Google Workspace, for example, uses the google selector by default:
- Type: TXT Record
- Host:
google._domainkey - Value:
v=DKIM1; k=rsa; p=MIIBIjANBgkq...(the long key your provider shows) - TTL: Automatic
The value can be very long. Paste it exactly as your provider gives it, with no line breaks and no extra spaces. Namecheap accepts long TXT values and splits them into DNS strings behind the scenes, so you do not need to break it up manually. If the key looks truncated in the console, widen the field or paste into a plain text editor first to confirm you copied all of it. A truncated key is the classic cause of a DKIM body hash or signature failure.
Whichever shape you use, the general mechanics of DKIM are worth understanding, and how to set up DKIM explains the selector and key model provider-agnostically.
Step 3: Add your DMARC record
DMARC ties SPF and DKIM together with a policy and lives at a fixed host, _dmarc. Add one TXT record:
- Type: TXT Record
- Host:
_dmarc - Value:
v=DMARC1; p=none; rua=mailto:dmarc@example.com - TTL: Automatic
Start with p=none so you can observe without affecting delivery. The rua address is where aggregate reports are sent, so use a mailbox you can read. Once you have watched reports for a few weeks and confirmed all your legitimate mail authenticates, tighten the policy toward p=quarantine and then p=reject. The difference between those three settings is explained in DMARC none, quarantine, and reject, and the staged path to enforcement is in how to move DMARC from none to reject.
DMARC only passes when SPF or DKIM authenticates and aligns with the domain in the From header. That alignment requirement is the part most people miss, and it is worth reading SPF vs DKIM to see how the two feed DMARC.
Step 4: Save and verify the records actually took
Namecheap saves each record when you click the green checkmark next to the row. There is no separate "publish" button, but do confirm every row shows the checkmark and not an editing state. Namecheap DNS usually propagates within a few minutes, though it can take up to about 30 minutes.
Never assume the records are correct because you typed them correctly. Verify them:
- Quick check from a terminal: run
dig TXT example.com +shortfor SPF,dig TXT _dmarc.example.com +shortfor DMARC, anddig TXT google._domainkey.example.com +short(ordig CNAME ...for a CNAME-style key) for DKIM. You should see your exact values returned. - Full check: run your domain through the scanner at the top of this page. It confirms all three records parse correctly, flags the doubled-quote and duplicate-SPF mistakes automatically, and grades the result.
If a record does not show up, the usual culprits are a wrong Host value (full domain instead of @ or a bare label), a record still in edit mode without the checkmark clicked, or the domain quietly using custom nameservers that are not Namecheap's. Re-check the nameservers first.
Frequently asked questions
Do I put my domain name or @ in the Namecheap Host field for SPF?
Use @. Namecheap's Host field appends your domain automatically, so @ means the root, example.com itself. If you type the full example.com into Host, it becomes example.com.example.com and fails. For DMARC use _dmarc, and for DKIM use just the selector label like google._domainkey, never the full name.
Why does Namecheap not show the Advanced DNS Host Records section?
Because the domain is not using Namecheap nameservers. Host Records are editable only when the domain runs on BasicDNS, PremiumDNS, or FreeDNS. If the Nameservers section shows Custom DNS pointing to another provider, add your records there instead. That other host is your real DNS.
Should DKIM be a CNAME or a TXT record on Namecheap?
It depends entirely on your email provider. Amazon SES and many marketing platforms give you CNAME targets so they can rotate keys for you. Google Workspace, Microsoft 365, and Zoho give you the full public key to paste into a TXT record. Use exactly the type your provider specifies, and never mix the two for the same selector.
How long does it take for Namecheap DNS changes to work?
Usually a few minutes, and typically no more than 30 minutes on Namecheap DNS. If a record still does not resolve after that, it almost always means the Host value is wrong or the row was never saved with the green checkmark, not that propagation is slow.