Your outgoing business emails are hitting the spam folder, or incoming messages are bouncing with cryptic 550 relay errors. You need your custom domain routing through Namecheap Private Email with bulletproof MX, SPF, and DKIM records across whatever DNS manager you happen to use.
Relying on registrar auto-configuration wizards often fails the second you point nameservers to a third party or manage zone files in Cloudflare, AWS Route 53, or an external web host. In this walkthrough, I will show you the exact hostnames, priorities, string formats, and terminal commands needed to configure authentication records by hand and verify that mailbox headers pass DMARC scrutiny.
The Default Namecheap Preset Trap
Namecheap provides a one-click dropdown option labeled “Namecheap Private Email” inside their Advanced DNS panel. If your domain uses BasicDNS or PremiumDNS, that button populates two MX records and a basic TXT record automatically. The trouble starts when your DNS records live elsewhere.
Whenever I migrate a client to an external server or proxy traffic through an edge network, that auto-configurator disappears. Even worse, if you previously selected Point Namecheap DNS to Hostinger Without Breaking Email, automated presets can overwrite live production mail routing without warning.
Another issue is DKIM. Namecheap does not automatically activate DKIM on older mailboxes or domains registered through external registrars. You get MX and SPF, but without DKIM, Gmail and Yahoo will reject or rate-limit your marketing and transactional messages under their current authentication rules.
Gathering Your Namecheap Mail Records
Before editing any zone file, make sure you have the exact server endpoints Namecheap assigned to your mailbox cluster. Namecheap operates two main server clusters for Private Email (formerly known as Jellyfish / Open-Xchange infrastructure), though 99% of domains use the primary cluster endpoints.
Log into your Namecheap account, navigate to Private Email from the left sidebar, and click Manage next to your email subscription. Look for the associated domain name and confirm whether your subscription is active. You will need four distinct pieces of information:
- Inbound Mail Servers (MX):
mx1.privateemail.comandmx2.privateemail.com - Priority values: 10 for primary, 20 for secondary
- SPF String:
v=spf1 include:spf.privateemail.com ~all - DKIM Selector: Either a CNAME selector (common on newer accounts) or a generated TXT public key (
default._domainkey)
If you also send automated transactional notifications from scripts, remember that your web host needs separate relay permissions. See our guide on subdomain email routing with custom MX and SPF if you plan to separate transactional mail from personal inboxes.
Adding the MX Records by Hand
MX (Mail Exchanger) records tell sending MTAs (Mail Transfer Agents) where to route emails addressed to user@yourdomain.com. You need exactly two records pointing to Namecheap’s servers. If you have legacy records like mail.yourdomain.com or leftover webmail records from cPanel, delete them now. Multiple conflicting MX records will cause random message drops.
Here is what your zone file syntax should look like in a standard BIND-compatible format or external DNS manager:
; MX Records for Apex Domain
@ 3600 IN MX 10 mx1.privateemail.com.
@ 3600 IN MX 20 mx2.privateemail.com.If your DNS manager uses form fields instead of raw zone syntax (such as Cloudflare or Namecheap Advanced DNS):
- Set Type to
MX. - Set Host or Name to
@(representing the root domain). - Set Mail Server or Value to
mx1.privateemail.com. - Set Priority to
10. - Set TTL to
Automaticor3600(1 hour). - Repeat for the second record using
mx2.privateemail.comwith priority20.
Do not forget the trailing dot if your DNS editor requires fully qualified domain names (FQDNs). Failing to add it on systems like BIND or raw cPanel zone editors appends your domain name twice, creating mx1.privateemail.com.yourdomain.com, which immediately breaks delivery.
Building the Correct SPF Record
Sender Policy Framework (SPF) specifies which servers are authorized to send email on behalf of your domain name. SPF is published as a standard DNS TXT record at the root of your domain. A common mistake I see developers make is creating multiple SPF records. The SPF standard (RFC 7208) explicitly forbids multiple SPF TXT records on a single host. If you have two, receiving mail servers flag both as invalid (PermError), and your deliverability drops immediately.
If you only send mail through your Namecheap Private Email webmail and desktop clients, this single line is your complete SPF configuration:
; Standard SPF Record
@ 3600 IN TXT "v=spf1 include:spf.privateemail.com ~all"What happens if you also send emails from a third-party relay or a transactional service like SendGrid, Postmark, or your own VPS web application? You merge the authorized mechanisms into a single SPF line before the terminating ~all or -all tag.
For example, if you send messages from Namecheap webmail and an application hosted on an IP address like 198.51.100.45, format the record like this:
; Merged SPF with an external server IP
@ 3600 IN TXT "v=spf1 ip4:198.51.100.45 include:spf.privateemail.com ~all"Keep in mind the hard limit of 10 DNS lookups per SPF query. The include:spf.privateemail.com entry counts as one lookup. If you exceed 10 lookups across all included providers, SPF fails unconditionally.
Extracting and Formatting the DKIM Key
DomainKeys Identified Mail (DKIM) attaches a cryptographic signature to the header of every outgoing message. When the receiver gets the email, they query your DNS for the corresponding public key and verify the digital signature against the message body.
Namecheap Private Email manages DKIM differently depending on whether your domain DNS is hosted with Namecheap or an external provider. Here is how to generate and locate your DKIM keys:
- Log in to your Private Email Webmail interface (usually at
mail.privateemail.com) using your admin credentials. - Click the Gear icon (Settings) in the top-right corner.
- Select Email Accounts or look under the administrative domain management section.
- Click your domain name, then locate the DKIM toggle or button.
- Click Generate DKIM.
Namecheap will display either a TXT record format or a pair of CNAME records. If it provides a TXT record, the host is usually default._domainkey.
Here is what the standard DKIM TXT record looks like:
;
Namecheap DKIM Public Key Record
default._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3...[truncated-public-key]...IDAQAB"When pasting this record into third-party DNS managers like Cloudflare or Namecheap’s own Advanced DNS:
- Record Type:
TXT - Host / Name:
default._domainkey(Do not add your domain suffix if the interface appends it automatically). - Value / Text: Paste the full string starting with
v=DKIM1; k=rsa; p=...without line breaks or extraneous spaces.
If Namecheap assigned you CNAME-based DKIM (frequently using selectors like s1._domainkey and s2._domainkey), map each selector to the provided Namecheap target hostname (such as s1._domainkey.privateemail.com).
If you are running your DNS on external hosting, you can cross-reference our guide on how to configure Namecheap Private Email MX on Hostinger nameservers to see platform-specific field layouts.
Adding DMARC to Stop Spoofing
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It tells receiving servers like Google, Yahoo, and Microsoft what to do if an incoming email claiming to be from your domain fails both SPF and DKIM checks.
Without DMARC, major providers might still deliver suspicious mail to spam, but having an explicit policy improves your sender reputation score. Begin with a reporting-only policy (p=none) so you do not accidentally drop legitimate mail while verifying your setup.
Create a new TXT record with the host set to _dmarc:
;
DMARC Policy Record
_dmarc 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100; sp=none"Breakdown of these tags:
v=DMARC1: Identifies the record as DMARC version 1.p=none: Monitor mode. If an email fails SPF or DKIM, deliver it anyway and log the incident.rua=mailto:...: The destination address for aggregate XML reports sent by receiving mail servers.pct=100: Applies this policy to 100% of outbound messages.sp=none: Extends the same monitoring policy to subdomains.
Once you verify that your legitimate emails are properly signed and passing both SPF and DKIM checks, you can upgrade your policy to p=quarantine (sends failed emails to spam) or p=reject (blocks failed emails completely).
Testing Deliverability with Dig and Mail-Tester
Never assume DNS records are working just because your control panel saved them without an error message. DNS caches take time to expire, and subtle syntax errors can slip through.
Open your local terminal and query your records directly using dig. Replace example.com with your actual domain name.
What I ran to verify MX records:
dig +short MX example.comExpected output:
10 mx1.privateemail.com.
20 mx2.privateemail.com.Next, inspect your SPF record:
dig +short TXT example.com | grep "v=spf1"Expected output:
"v=spf1 include:spf.privateemail.com ~all"Next, query the DKIM selector. Remember that DKIM records are not published at the apex domain—they live at the selector subdomain:
dig +short TXT default._domainkey.example.comIf dig returns your v=DKIM1 string containing the RSA key, the public key is live on the internet. Finally, verify the DMARC policy:
dig +short TXT _dmarc.example.comOnce command-line lookups succeed, send a test email from your Namecheap Private Email account to a diagnostic tool like mail-tester.com or an external Google Workspace address. In Gmail, open the test message, click the three vertical dots in the message header, and select Show original.
Inspect the authentication summary box at the top. You should see three clean green passes:
- SPF: PASS with domain
example.com - DKIM: PASS with domain
example.com - DMARC: PASS
Gotcha: Namecheap Webmail DKIM “Pending” State
Here is an issue I ran into when setting up an external domain last month. In the Namecheap Private Email admin interface, the DKIM toggle stayed stuck on “Pending Verification” for over twenty-four hours, even though running dig showed the public key was answering correctly across global DNS resolvers.
The issue stems from internal cache TTLs inside Namecheap’s control plane. Their background verification worker only checks the external DNS zone every few hours. If your domain has a long TTL on the root domain (like 86400 seconds), Namecheap’s local resolver will cache the missing record state.
To bypass this delay:
- Drop your DNS TTL values to
300(5 minutes) before generating the DKIM record. - Paste the record into your DNS provider.
- Verify it resolves against Google Public DNS using
dig @8.8.8.8 default._domainkey.example.com TXT. - In the Private Email portal, toggle the DKIM switch Off, wait 60 seconds, and toggle it back On.
This forced an immediate re-query in my setup, turning the status indicator green within four seconds instead of waiting a day for the background cron job.
Frequently Asked Questions
Why are incoming emails bouncing after adding MX records?
If you just created the MX records, old DNS caches may still point to empty or expired mail handlers. Wait for your previous TTL duration to clear (usually 300 to 3600 seconds). Also, verify you did not leave any default cPanel or parking MX records in your zone file.
Can I have more than one SPF record for my domain?
No. Having multiple TXT records starting with v=spf1 violates the SPF specification. If you use both Namecheap Private Email and an email newsletter service, combine them into one record: v=spf1 include:spf.privateemail.com include:sendgrid.net ~all.
What is the difference between ~all and -all in SPF?
The tag ~all designates a SoftFail, meaning unauthorized emails are accepted but flagged as suspicious. The tag -all designates a HardFail, directing receiving servers to reject unauthorized emails outright. While testing new records, stick with ~all to prevent legitimate messages from disappearing if an external sending IP is missing.
Where do I find my DKIM selector if “default” does not resolve?
Check your Private Email dashboard or the DNS instructions provided in your welcome email. While most accounts use default._domainkey, newer clusters occasionally assign numbered selectors like s1._domainkey or custom alphanumeric hashes. You must use the exact selector generated in your webmail management portal.
Next Steps
Once your mail routing and cryptographic signatures pass deliverability tests, check our step-by-step tutorial on how to set up Namecheap Private Email MX records on standard setups for automated client rollouts, or configure an external transactional mail pipeline without contaminating your primary domain’s sender score.
