SPF record for domains that do not use our DNS

When a domain hosted with us uses our DNS, the SPF record is set up automatically and, if needed, edited in cPanel.

But when external DNS is used, for example because you use Cloudflare, this record is managed in the panel of the provider responsible for that DNS.

First check the existing SPF TXT record in the authoritative zone. A domain must publish a single record starting with v=spf1; if one already exists, add the following mechanism before its final all instead of creating a second record:

+a:spf.theservercluster.com

If Hostsuar is the only system authorised to send, a strict example would be:

v=spf1 +a:spf.theservercluster.com -all

If Google Workspace, Microsoft 365, a campaign platform or any other service also sends, keep their mechanisms in the same SPF. Do not replace the whole record with the example without first identifying every legitimate sending source.

Where to paste it and how to check it

The a:spf.theservercluster.com mechanism is part of the sending domain's SPF TXT value; it is not the name of a new A record. Keep its mechanism type: a: and include: are not interchangeable.

In Cloudflare or another DNS editor, find the existing SPF TXT record, keep its previous value and edit that same record. Do not touch the MX records: they authorise different things. If you use the root domain, the editor may show it as @ or as the full name.

After saving, look up the public TXT record and send a test from the Hostsuar SMTP. Check SPF and the return-path domain in the receiver's headers. If the message actually goes out from an external platform, it will need that platform's configuration.

See how to manage SPF to review the lookup limit and SPF and DKIM to complete the authentication.