How to Set Up Business Email: MX, SPF, DKIM and DMARC Records, Outlook, Gmail and Phones

Setting up company email has two halves. The DNS records tell the world where to deliver your mail and let receiving servers check that your messages are genuine; the app settings connect each person's computer and phone to their mailbox. Do the records first, test them, and only then connect the devices.

Before you start

• Know where your domain's DNS is managed: in your hosting control panel if the domain uses your host's nameservers, otherwise at the registrar or another DNS provider. Our domain registration and DNS guide explains the difference.
• Create the mailboxes in cPanel under Email Accounts.
• Note the incoming and outgoing server names, ports and security settings shown in your control panel (in cPanel, under Connect Devices next to each mailbox). Use those exact values, not settings copied from another provider.

Step 1: MX records decide where mail is delivered

An MX record names the server that accepts mail for your domain. Each one has a priority number, and sending servers try the lowest number first. Three rules prevent most problems:

• An MX record must point to a hostname, never directly to an IP address and never to a CNAME.
• Remove MX records left over from a previous provider; a mix of old and new records sends some messages to the old system.
• If the website is on a cPanel account but the domain's email is hosted elsewhere, set the domain's Email Routing to Remote Mail Exchanger; otherwise mail your website sends to your own addresses ends up in an unread local mailbox.

When the domain uses your host's nameservers and the email is in the same cPanel account, the MX record is normally created automatically.

Step 2: SPF lists who may send for your domain

SPF is a TXT record on the domain itself that lists the servers allowed to send mail from your addresses. It starts with v=spf1, continues with the allowed sources (mechanisms such as a, mx or include:), and ends with ~all (soft fail) or -all (fail) for everything else. cPanel's Email Deliverability tool shows a suggested SPF value for your account, which is the safest starting point.

• Publish only one SPF record per domain. Two separate SPF records make the check fail, so merge them into one.
• Include every service that sends as your domain: the mail server, the website's contact forms, invoicing or CRM systems and newsletter tools.
• SPF allows at most 10 DNS lookups, and long chains of include: entries can exceed that limit.

Step 3: DKIM signs every message

DKIM signs outgoing messages with a private key held on the mail server. The matching public key is published as a TXT record named selector._domainkey.yourcompany.com, where the selector is a label chosen by the server, and receivers use it to confirm the message was not altered on the way. In cPanel, Email Deliverability generates the key and shows the exact record name and value. Copy the value exactly; some DNS panels need such long values split into several quoted strings.

Step 4: DMARC sets your policy and reports

DMARC tells receiving servers what to do with a message that shows your domain in the From address but passes neither SPF nor DKIM for that same domain, and where to send reports. It is a TXT record at _dmarc.yourcompany.com. Introduce it gradually:

• Start with v=DMARC1; p=none; rua=mailto: followed by an address that will receive the reports. Nothing is blocked at this stage; you only collect data.
• After a few weeks, once the reports show all legitimate senders passing, move to p=quarantine so failing mail goes to spam.
• Finally move to p=reject, which blocks forged mail that uses your domain.

Step 5: Test before you connect anyone

Once the records take effect (this depends on their TTL), check them with nslookup -type=mx yourcompany.com or dig txt _dmarc.yourcompany.com. Send a message from the new mailbox to a Gmail address, open it and choose "Show original": SPF, DKIM and DMARC should all say PASS. If any of them shows FAIL, fix it before the team starts sending.

IMAP or POP3?

According to the plan pages, EngHosting's email plans support IMAP, POP3 and SMTP. Choose IMAP for almost everyone: messages stay on the server, and every device sees the same folders, read status and sent items. POP3 downloads messages to one device and suits only a single-computer mailbox that you back up yourself. For sending, use SMTP with authentication turned on.

Connecting Outlook on a computer

• Add a new account, enter the full email address, then choose the advanced or manual setup option (menu names vary between Outlook versions) and select IMAP.
• Enter the incoming and outgoing server names, ports and encryption (SSL/TLS) exactly as shown in your control panel. Secure IMAP normally uses port 993 and secure SMTP 465 or 587, but the values in your panel are the ones to use.
• Use the full email address as the username for both servers, and make sure the option that the outgoing server requires authentication is on.

The Gmail app, iPhone and Android

• Gmail app on Android or iPhone: tap your profile picture, choose to add another account, then Other. Enter the address, pick IMAP when asked for the account type, and fill in the incoming and outgoing server details from your control panel.
• Mail on iPhone and iPad: open Settings, go to Mail (under Apps in recent iOS versions), then Accounts or Mail Accounts, Add Account, Other and Add Mail Account, and enter the IMAP and SMTP details. cPanel's Connect Devices page can also offer a configuration profile that does this automatically.

Other Android mail apps follow the same pattern: manual setup, IMAP, then the server details. For occasional access, the webmail included with the plan works in any browser.

Common problems and fixes

• Authentication failed: the username must be the full address, not just the part before the @. Test the password in webmail first.
• You receive but cannot send: SMTP authentication is off or the port is wrong. Some networks block port 25, so use the secure submission port shown in your panel.
• Messages land in spam: look for a missing or duplicated SPF record, an unpublished DKIM key, or a DMARC policy tightened too early.
• Certificate warning: the server name in the app does not match the server's SSL certificate; use exactly the hostname shown in your panel.

According to the plan pages, the EngHosting email hosting plans include webmail, cPanel email management, SSL-secured connections and spam protection, and the Starter and Advanced plans list free setup; Arabic technical support is available through tickets, phone and WhatsApp. Moving existing email from another provider? Plan the switch with our guide to migrating without downtime. For the business case, read why company email belongs on your own domain.