How to Add SPF/DKIM/DMARC in HestiaCP

Prerequisites

Before configuring SPF/DKIM/DMARC, make sure you have:

• Access to HestiaCP control panel
• A domain with email service enabled
• SSH access (for DKIM key generation)

What are SPF, DKIM, and DMARC?

• SPF - Specifies which mail servers can send email for your domain
• DKIM - Adds digital signature to emails to verify authenticity
• DMARC - Tells receiving servers what to do with emails that fail SPF/DKIM

Part 1: Configure SPF Record

Step 1: Log in to HestiaCP

https://YOUR_SERVER_IP:8083

Step 2: Go to DNS → Your Domain

Step 3: Add SPF TXT Record

Click Add DNS Record:

• Record Name: @ (blank)
• Record Type: TXT
• IP Address: v=spf1 mx ~all

For HestiaCP with external sending:

v=spf1 mx include:spf.hestiacp.com ~all

For Google Workspace:

v=spf1 include:_spf.google.com ~all

Part 2: Enable DKIM in HestiaCP

Step 1: Connect via SSH

ssh hxroot@YOUR_SERVER_IP -p 22

Step 2: Enable DKIM for Domain

/usr/local/hestia/bin/v-add-domain-dkim admin example.com

Replace admin with username and example.com with your domain.

Step 3: Get DKIM Record

/usr/local/hestia/bin/v-list-domain-dkim admin example.com

Output shows the DKIM TXT record to add to DNS.

Step 4: Add DKIM Record in HestiaCP DNS

• Record Name: default._domainkey
• Record Type: TXT
• IP Address: The DKIM value (starts with v=DKIM1; k=rsa; p=...)

Part 3: Configure DMARC Record

Step 1: Add DMARC TXT Record

In HestiaCP DNS, add:

• Record Name: _dmarc
• Record Type: TXT
• IP Address: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

DMARC Policy Options

Policy (p=)	Action
none	Monitoring only (no action)
quarantine	Mark suspicious emails as spam
reject	Reject failed emails entirely

Part 4: Verify Configuration

Check SPF:

dig example.com TXT | grep spf

Check DKIM:

dig default._domainkey.example.com TXT

Check DMARC:

dig _dmarc.example.com TXT

Testing Email Authentication

Send a test email and check headers for:

• spf=pass
• dkim=pass
• dmarc=pass