[ DNS-provider guides ]

Publish authentication DNS records in Namecheap without duplicating the zone name

Choose the correct Namecheap DNS service and use relative Host labels before checking authoritative records and mail alignment.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Verify the active service and authoritative DNS before editing.
  • Preserve record types, owner names and existing authorized services.
  • Verify public answers and actual aligned mail separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify public answers and actual aligned mail separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Keep Namecheap DNS configuration evidence reproducible

Separate the DNS values, sender settings and received-message results.

Next steps

  1. Capture previous records and exact account scope.
  2. Compare authoritative answers with the issued worksheet.
  3. Keep the exact route and selector in the evidence record.

CISO / SecOps

Require scoped assurance for Namecheap DNS

Documentation alone does not prove the organization’s live mail is authenticated.

Next steps

  1. Retain provider scope and human review gates.
  2. Reject unsupported authentication guarantees.
  3. Review residual risk before removing the release hold.

Founder / Non-technical

Protect the Namecheap DNS change window

Schedule a small record change with a clear rollback rather than altering unrelated mail hosting.

Next steps

  1. Name the business owner and pause authority.
  2. Require a controlled acceptance test before broad rollout.
  3. Budget time for the provider and DNS owner to resolve exceptions.

[ FAQs ]

Frequently asked questions

Which Namecheap DNS products does this editor guide cover?

The first-party instructions cover BasicDNS, PremiumDNS and FreeDNS; Web Hosting DNS uses cPanel instead.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

What represents the root domain in Host?

Use @ in this documented Namecheap editor.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Should Host include my full domain name?

No. The guide specifies relative labels and says to omit the domain itself.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

What do I enter for a DKIM selector?

For a selector under the selected zone, enter its relative selector._domainkey owner and the record type/value supplied by the signer.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Can Namecheap DNS enable my provider’s signing?

Publishing a key or delegation alone does not activate the sender. Complete its account configuration and verify a message.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Should I copy the example reject policy?

No. Choose enforcement only after the organization’s sender inventory and risk review, not as an incidental DNS-editor step.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Is a provider propagation estimate an acceptance test?

No. Inspect authoritative answers and recursive caches, then test the real sending workflow.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

What if the Advanced DNS edit has no effect?

Check delegation, the selected DNS product, the exact resulting owner and cached answers before changing values again.

Namecheap TXT SPF DKIM DMARC records Namecheap host records SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

[ Sources ]

Sources

  1. Namecheap TXT SPF DKIM DMARC records

    Sections Product scope178–180; editor235–243; relative Host240–241

  2. Namecheap host records

    Sections Host records and CNAME record type instructions

  3. SPF RFC 7208

    Sections §3.2; 3.3; 4.6.4

  4. DKIM RFC 6376

    Sections §3.5; 3.6.2; 6.1

  5. DMARC RFC 9989

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Authoritative DNS
The servers responsible for publishing the domain’s DNS data.
Envelope domain
The SMTP sender domain evaluated by SPF.
DKIM selector
The label identifying a public key under the signing domain.
Alignment
The required relationship between the visible From domain and a passing authentication identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base