SPF record for Namecheap Private Email

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Private Email only (as Namecheap documents it)

Type: TXT · Host: @ · 4 of 10 DNS lookups Copy

v=spf1 include:spf.privateemail.com ~all

Private Email and Mailjet for newsletters

Type: TXT · Host: @ · 5 of 10 DNS lookups Copy

v=spf1 include:spf.privateemail.com include:spf.mailjet.com ~all

Private Email and Freshdesk (US data center)

Type: TXT · Host: @ · 5 of 10 DNS lookups Copy

v=spf1 include:spf.privateemail.com include:fdspfus.freshemail.io ~all

How SPF applies to Private Email mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Private Email sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Namecheap's third-party DNS table lists five required records for Private Email: two MX records (mx1.privateemail.com and mx2.privateemail.com, priority 10), the SPF TXT, a DKIM TXT and a DMARC TXT.
• The mail, autodiscover and autoconfig CNAMEs and the _autodiscover SRV record Namecheap lists are optional and don't affect delivery or SPF.

How to add it

1. Find out where your domain's DNS is hosted: Namecheap BasicDNS, Namecheap Web Hosting DNS, Premium DNS or a third-party provider.
2. At that DNS host, look for a TXT record on @ that starts with v=spf1.
3. If there is one, add include:spf.privateemail.com to it. If there isn't, create a TXT record with host @ and value v=spf1 include:spf.privateemail.com ~all.
4. Add the DKIM TXT record from your Private Email subscription and a DMARC record on _dmarc at the same time.
5. Namecheap says to allow up to 30 minutes for propagation before testing; then check the live record with the SPF Checker below.

DKIM and DMARC alignment

Namecheap says the DKIM record is mandatory for outgoing Private Email to work correctly. It is a TXT record named privateemail._domainkey (or default._domainkey for subscriptions bought before 2 June 2026), with a key unique to your subscription. Namecheap's example DMARC record is v=DMARC1; p=none; with a report address; once mail passes, tighten it as in our DMARC record examples.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Private Email's include costs 4 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Private Email's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Leaving an SPF record from your previous mail host and adding a second one for Private Email. Merge the includes into one v=spf1 record.
• Adding the records at Namecheap while the domain's nameservers point to another DNS host. They only work where the nameservers point.