How to add MX, SPF, DKIM and DMARC records in Bluehost

Records you add at Bluehost only count while the domain uses Bluehost's nameservers. If it points to Cloudflare or another DNS host, add the records there instead. Check from a terminal:

Bluehost has two places to edit DNS: the DNS tab in the Bluehost Portal, which Bluehost's current help articles use, and Zone Editor in cPanel (Hosting > My Plans > cPanel > Domains > Zone Editor). Use the one your account shows; the steps for both are below. Have the records from your email service ready, and copy them with its copy buttons rather than retyping them.

Log in to the Bluehost Portal and select Domains in the left-hand menu. If you have more than one domain, select the one you want. Open the DNS tab; it takes you to Manage Advanced DNS Records. Look through the TXT records for one starting v=spf1 and one named _dmarc before you add anything.

Select + Add Record on the right and choose Single record. (Multiple records lets you add several of one type, then Save them together.)

Choose TXT as the Type. Then set the host, which Bluehost's articles call Refers to, Host Record or Host Name depending on the page: choose @ for the root domain; for any other name, choose Other Host and type the name before your domain, such as _dmarc or s1._domainkey.

After you add the record, check how it appears in the list. It should read _dmarc.example.com or _dmarc; if your domain shows up twice, as _dmarc.example.com.example.com, edit the host and remove the extra domain.

Paste the value into TXT Value exactly as your provider gives it, on one line and without surrounding quotation marks. Leave TTL at its default; Bluehost's own SPF instructions use 4 hours.

Select Add to create the record. Bluehost says record changes usually show within a few minutes and can take up to 8 hours to reach everyone.

In cPanel, open Zone Editor under Domains and select Manage next to the domain (or the + button for the record type). Select + Add Record, choose the type, and fill in Name, TTL and the record. cPanel adds your domain to a name you type, so _dmarc becomes _dmarc.example.com.; if you type the full name, end it with a dot, as in _dmarc.example.com., so the domain isn't added twice. Select Save Record. cPanel's own docs warn that the record field accepts invalid data, so check what you pasted.

On the DNS tab, select + Add Record and Single record, then choose MX as the Type. Set the host to @ for mail to you@example.com, or to a subdomain such as inbound. Enter the mail server's host name in Points to (it must be a host name, never an IP address) and the Priority your provider gives you: lower numbers are tried first. Leave TTL at its default and save.

By default a Bluehost domain's MX record points at the domain itself, so mail is handled on Bluehost's servers. If you're moving the domain's email elsewhere, delete the old MX record from the MX (Mail Exchanger) list (three-dot menu) once the new ones are in. Bluehost warns that removing an MX record stops the email connected to it, so only do this for the mail you're moving.

In the Bluehost Portal go to Hosting > My Plans, select cPanel Email, then Email Routing. Choose Remote Mail Exchanger if the domain's email is not hosted by Bluehost, or Local Mail Exchanger if it is, and select Change. Bluehost advises against Automatically Detect Setting. With the wrong setting, Bluehost's server can keep mail for the domain to itself, for example contact-form mail sent from your own website.

Bluehost adds a default SPF record to the zone of every domain it hosts, and its SPF guide says to remove that default before you install a new one. Either way, the goal is a single record: two v=spf1 records make SPF fail for every message.

Before deleting the default, look at what it contains (cPanel's Email Deliverability page shows the value Bluehost expects). If you still send any mail through Bluehost, such as Bluehost mailboxes or a WordPress site using the server's mail, copy those parts into the new record so it covers both:

Keep one all term, at the very end, and stay under the limit of 10 DNS lookups. The SPF checker counts them and flags a second SPF record.

Add the key as a TXT record with the host set to Other Host and selector._domainkey, or as a CNAME if your provider gives you a target. Paste the key as one line without quotes; a 2048-bit key is about 400 characters and DNS stores it as several strings that receivers join back together. Only one DKIM record can exist per selector, so delete any duplicate. If cPanel's Email Deliverability page offers to install a suggested record, Bluehost's own DKIM guide says not to click it; add records in the DNS tab instead.

Add one TXT record with the host _dmarc. Start at p=none with a rua= address you read, then move to quarantine and reject once the reports show every legitimate sender passing. If a _dmarc record already exists, edit it instead; two DMARC records make receivers ignore both. The SPF, DKIM and DMARC guide has the rollout plan.

Choose CNAME, set the host under Other Host (for example rp), and enter the target host name in Points to. A CNAME can't share its name with any other record, and it must point to a host name, not an IP address.

On Windows, nslookup -type=TXT _dmarc.example.com 1.1.1.1 does the same job.

When you add a domain to Groundmail, you get the records below. Here they are written the way Bluehost's host field wants them for example.com: @, or the name under Other Host.

The dashboard shows full host names, such as _groundmail.example.com. Your DNS host adds the domain itself, so type only the part before it. If you added a subdomain such as mail.example.com, keep the subdomain in the name: _groundmail.mail, ss-abc123._domainkey.mail, rp.mail, mail for SPF and _dmarc.mail.

Merge include:spf.groundmail.dev into the domain's one SPF record rather than adding a second. If you turn on receiving, the Groundmail MX record is best on a subdomain, with Email Routing for it set to Remote Mail Exchanger. Copy the real values from any of these:

Then select Verify DNS on the domain's page. Home reads your public DNS and names any record it can't find yet, and the DNS records tab marks each record and keeps re-checking while the domain is pending, so you can see which one is missing instead of waiting and guessing. Verifying also switches signing to your own domain, so messages carry a DKIM signature for example.com and DMARC can pass.

New to Groundmail? It sends your app's sign-in codes, password resets and receipts, and the free plan includes 3,000 emails a month with no time limit. Create a free account, add your domain, and the records above are generated for you.