How to Set Up DMARC for Namecheap | SimpleDMARC

Why Namecheap Needs Its Own Walkthrough

Namecheap is primarily a domain registrar. Some domains run Namecheap's own Private Email product; others route mail through Microsoft 365, Google Workspace, or another provider entirely, with Namecheap only holding the DNS. Figure out which one applies to you before touching SPF — the two paths need different records.

Start with p=none, same as anywhere else. You want to see what's actually sending mail before you risk blocking any of it.

Step 1Generating Your DMARC Record

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-reports@yourdomain.com; fo=1; adkim=r; aspf=r; pct=100

p=none means monitor only — nothing gets blocked while you confirm every legitimate sender is passing. rua/ruf are where your reports land, and relaxed alignment (adkim=r, aspf=r) is the right starting point while you're still mapping out senders.

Step 2Publish the Record in Namecheap's Advanced DNS Panel

Domain List → Manage next to your domain → Advanced DNS tab → Add New Record → TXT Record.

Paste the full record into the Value field, leave TTL on Automatic, and save. Namecheap's panel occasionally takes a few minutes to visually reflect a saved change even though the underlying DNS update is usually faster — don't assume it failed if it doesn't appear right away.

Step 3Configure SPF for Your Real Email Provider

If you're using Namecheap Private Email:

v=spf1 include:spf.privateemail.com ~all

If Namecheap only holds your DNS and you're actually on Microsoft 365 or Google Workspace, use that provider's include instead:

v=spf1 include:spf.protection.outlook.com ~all

Check for an existing SPF record before adding a new one — don't publish a second one. Merge include statements into a single record if one already exists.

Step 4Enable DKIM

If you're on Private Email, DKIM setup happens in the Private Email control panel (accessible from your Namecheap dashboard), not Advanced DNS directly. Enable it there, and Namecheap gives you a TXT record to publish back in Advanced DNS, typically at a host like default._domainkey.

If you're using Microsoft 365, Google Workspace, or another third-party provider instead, follow that provider's own DKIM process — Namecheap's DNS panel just hosts whatever record it requires.

Step 5Wait for Enforcement (Monitor First)

Give it one to two weeks before touching your policy. Watch reports for anything unrecognized failing, and confirm what percentage of mail already passes cleanly. Then move to p=quarantine, and eventually p=reject, by updating the same record.

Step 6Verify Your Setup

• Check the record with a DMARC Checker — this will immediately flag the Host field issue if that's the problem
• Confirm SPF with the SPF Checker
• Send a real test message and check the authentication results on the receiving end.