How to Configure SPF, DKIM, and DMARC Records in Namecheap BasicDNS

If your emails are suddenly hitting spam or bouncing with 550 errors, you’re not alone. Google and Yahoo cranked up their sender requirements, so unauthenticated domains get penalized immediately. If your domain sits on Namecheap BasicDNS and you send mail via Google Workspace, Postmark, SendGrid, or Namecheap Private Email, you need SPF, DKIM, and DMARC configured properly or your messages won’t make it to inboxes.

Here’s how to configure all three records directly in Namecheap BasicDNS without breaking existing mail flows.

Understanding the Email Authentication Trio

Three DNS records work together to prove you actually sent the email:

• SPF (Sender Policy Framework): A TXT record listing the specific servers and IPs allowed to send mail on your domain’s behalf.
• DKIM (DomainKeys Identified Mail): A public cryptographic key in your DNS that verifies the email header and body weren’t tampered with along the way.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): A policy record telling mailbox providers what to do when SPF or DKIM checks fail (quarantine, reject, or just monitor), and where to send error reports.

Per the Google Workspace Email Sender Guidelines, skipping any of these will trash your domain reputation. Let’s get them in place.

Step 1: Access the Namecheap Advanced DNS Tab

First, verify your domain actually resolves through Namecheap BasicDNS. If your NS records point to Cloudflare or another DNS host, changing values in Namecheap won’t do anything.

1. Log in to your Namecheap Dashboard.
2. Click Domain List on the left sidebar.
3. Find your domain and hit Manage.
4. Check the Nameservers dropdown. Make sure Namecheap BasicDNS is selected. If you previously configured custom nameservers and glue records, you must add these records over at your active DNS provider instead.
5. Click the Advanced DNS tab near the top.

Scroll down to the Host Records table. This is where we’ll drop our records.

Step 2: Add or Merge Your SPF Record

SPF lives as a TXT record at your root apex (@). The single most common mistake here is creating two separate SPF records. That breaks RFC 7208 and causes receiving servers to throw a permanent PermError.

In the Host Records table, click Add New Record, select TXT Record, and configure:

• Type: TXT Record
• Host: @
• TTL: Automatic (or 1 min if you want rapid testing)

If you’re only using Google Workspace, paste this into the Value field:

v=spf1 include:_spf.google.com ~all

If you run Namecheap Private Email alongside a transactional service like Postmark, merge them into one SPF string:

v=spf1 include:spf.eforward.cteccdn.com include:spf.postmarkapp.com ~all

Stick with ~all (SoftFail) while getting everything tested. Once you’re certain no rogue servers or SaaS platforms are sending on your behalf, you can tighten it to -all (HardFail).

Step 3: Configure DKIM Records (TXT or CNAME)

DKIM uses a selector subdomain to serve a public key that matches your provider’s private signing key. Providers generally hand you either a CNAME or a raw TXT record.

Option A: Adding a DKIM CNAME Record

Services like Postmark, SendGrid, and AWS SES use CNAMEs so they can handle key rotation automatically. They’ll typically give you two records.

If Postmark tells you to point pm._domainkey.example.com to pm.dkim.postmarkapp.com, do not paste the whole hostname into Namecheap. Strip out your domain:

• Type: CNAME Record
• Host: pm._domainkey
• Value: pm.dkim.postmarkapp.com.
• TTL: Automatic

Option B: Adding a DKIM TXT Record

Google Workspace and self-hosted setups give you a raw 1024-bit or 2048-bit key. In Google Admin, you generate this under Apps > Google Workspace > Gmail > Authenticate email.

Add a new record in Namecheap:

• Type: TXT Record
• Host: google._domainkey
• TTL: Automatic

Paste your full key string into the Value field:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Yp7Kx7vP9d...DAQAB

Save it, then head back to Google Admin and click Start Authentication. Namecheap’s current UI handles long 2048-bit keys cleanly without needing manual string concatenation.

Step 4: Create Your DMARC Policy Record

DMARC tells receiving mail servers what to do if an incoming email fails SPF or DKIM alignment checks. It always lives at the _dmarc host.

Per the DMARC.org specifications, always start in monitoring mode (p=none). Never jump straight to p=reject on day one unless you want to risk dropping legitimate outgoing emails by accident.

Add another record in Namecheap:

• Type: TXT Record
• Host: _dmarc
• TTL: Automatic

Paste the base policy into the Value field (swap in your own reporting email):

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100; sp=none; aspf=r; adkim=r

Breaking down what this does:

• v=DMARC1: DMARC version tag (must be first).
• p=none: Monitoring mode. Keeps your mail flowing normally while sending aggregate XML reports.
• rua=mailto:...: Where daily aggregate deliverability reports get sent.
• pct=100: Applies this policy to 100% of outgoing messages.
• aspf=r / adkim=r: Relaxed alignment mode for SPF and DKIM.

The Classic Namecheap DNS Gotchas

A few quirks in Namecheap’s DNS UI trip people up constantly:

• Automatic Domain Suffix: Namecheap automatically appends your domain to whatever you type in the Host field. If you enter _dmarc.example.com, you’ll publish to _dmarc.example.com.example.com. Enter only _dmarc or selector._domainkey.
• Duplicate SPF Records: Having two separate v=spf1 records on @ breaks validation instantly. Merge them into a single string with multiple include: mechanisms.
• Use @ for Apex: For root TXT records, always type @ in the Host field rather than leaving it empty.
• CNAME Collisions at Apex: DNS specs prohibit CNAME records on root apex domains. If you run your site somewhere like Vercel, make sure you use an A Record on @ so your TXT records resolve cleanly, just like we do when we point a Namecheap domain to Vercel.

Verifying Your DNS Propagation via Terminal

Instead of relying on web tools that might serve stale cached DNS, query your records directly from the terminal.

Run these dig queries:

# Check your root SPF record
dig example.com TXT +short # Check your DKIM record (replace 'google' with your selector)
dig google._domainkey.example.com TXT +short # Check your DMARC record
dig _dmarc.example.com TXT +short

If you’re on Windows, use PowerShell’s Resolve-DnsName:

Resolve-DnsName -Name example.com -Type TXT
Resolve-DnsName -Name google._domainkey.example.com -Type TXT
Resolve-DnsName -Name _dmarc.example.com -Type TXT

You can also run your domain through MXToolbox SuperTool to catch syntax warnings or malformed tags.

Inspecting Live Email Headers

Once DNS updates, send a real test email from your custom domain to a Gmail inbox to confirm end-to-end alignment.

1. Open the message in Gmail.
2. Click the three dots next to the Reply button.
3. Click Show original.

You want to see a clean sweep of green PASS statuses in the header summary:

SPF: PASS with IP 209.85.220.41
DKIM: 'PASS' with domain example.com
DMARC: 'PASS'

If anything returns FAIL or NEUTRAL, scroll down into the raw Authentication-Results block to see whether SPF failed IP matching or DKIM couldn’t find your selector.

Frequently Asked Questions

How long does it take for Namecheap DNS changes to take effect?

Namecheap pushes updates to its authoritative nameservers within 2 to 5 minutes. Global resolvers will cache your old records until their TTL expires, typically between 15 minutes and a couple of hours.

Can I have more than one DKIM record on Namecheap?

Yes. SPF is strictly limited to one record per host, but DKIM records live on independent selector subdomains (like google._domainkey and pm._domainkey). You can have as many DKIM records as you have sending services.

What happens if I set DMARC policy to reject immediately?

If you set p=reject before catching all legitimate outgoing mail sources (like transactional notifications, CRM tools, or support desks), those valid emails will get permanently dropped. Start with p=none for a couple of weeks to audit your incoming DMARC XML reports first.

Do wildcard subdomains affect SPF or DKIM?

Root SPF records don’t cascade down to subdomains automatically. If you send mail from mail.example.com or app subdomains, create explicit SPF and DKIM records for those specific hosts, even if you have wildcard subdomains in Namecheap.

Next Steps for Domain Management

With authentication locked down, your emails won’t get flagged as unverified junk. If you’re also setting up web apps or custom frontends on this domain, check out our walkthrough on how to point a Namecheap domain to Vercel to keep your apex records cleanly configured alongside your mail stack.