Scope: Afrihost shared hosting and cPanel
Afrihost publishes separate instructions for obtaining authentication records in cPanel and adding them through ClientZone’s Shared Hosting DNS Editor. This guide follows that documented route. It does not infer that Afrihost Pure Mail, an external mailbox provider, or every hosting package uses identical records or signing controls. Establish the actual email product and authoritative DNS service before preparing a change. The account-specific values and present interface applicability remain unverified.
The provider’s SPF generation instructions use cPanel’s Email Deliverability area: select Manage beside the domain, find SPF, and copy its Value. Its DKIM instructions use the same area and the Install The Suggested Record action. These are proposed operator steps, not actions performed for this manuscript. Afrihost SPF generation Afrihost DKIM generation
Separate generation, publication and signing
A suggested record is evidence of what a particular configuration interface recommends. It is not evidence that the public authoritative zone contains that value or that a message was signed and successfully verified. Preserve the domain context alongside the suggested record. An administrator who copies a value from the wrong hosting account can produce a plausible-looking but irrelevant change request.
For DKIM, distinguish the public verification material from any private signing material. The DNS record contains public key information. Private keys must not be collected in the acceptance worksheet or pasted into a ticket. The protocol connects a message’s signature to a signing domain and selector; those identifiers determine where a verifier looks for the key. A visually similar domain or a generic account label cannot replace them. RFC 6376, DKIM-Signature and key storage
Afrihost’s DKIM creation article says the record can be copied to the domain’s DNS cluster after the suggested record is installed. Treat this as a reason to establish who actually serves authoritative DNS. A local hosting view and an externally operated public zone may require different publication ownership. Do not conclude that the public record changed merely because a local interface displayed a success notification. Afrihost DKIM generation
Prepare the SPF change without discarding other senders
The documented ClientZone path is Hosting, the domain under Shared Hosting, Hosting Settings, DNS Editor, then Create New Record. For SPF, the article specifies TXT, a blank priority field, the copied SPF content and TTL 7200. That interface recipe does not justify creating a second SPF policy when one already exists. Review the existing policy and merge only the approved authorization changes. Afrihost SPF publication
SPF evaluates the SMTP identity, including MAIL FROM, rather than simply trusting the human-readable From field. Inventory applications that send for the relevant identity before modifying its policy. Hosted mailbox submissions, website notifications and an outside marketing tool may have different envelopes and infrastructure. Do not assume that a cPanel default includes every service the organization has adopted. RFC 7208, HELO and MAIL FROM identities
Retain one applicable SPF policy at the owner name. Review nested includes and other DNS-querying terms against the protocol’s evaluated-term limit. A short top-level policy can still have an excessive dependency path. Record the review method and evidence time, but do not label an unexecuted plan as a successful live evaluation. A cached answer does not waive the evaluation rules. RFC 7208, multiple records and DNS lookup limits
Resolve the DKIM owner-name ambiguity before publication
Afrihost’s DKIM publication page describes the ClientZone route and pasting a DKIM TXT value. However, its text includes an SPF-labelled instruction heading and a generic domain-name field rather than a complete account-specific selector owner. Those details are not a safe basis for inventing an apex DKIM record. Obtain and review the full generated name and value for the actual domain, and resolve the editor’s naming convention before authorizing publication. Afrihost DKIM publication
Under DKIM, the selector and signing domain form the key lookup name beneath _domainkey. The actual selector must come from the account’s supported configuration and match the messages being signed. Do not supply a guessed selector merely because another service uses it. The same rule applies to a copied public key: its syntax alone does not establish that the intended signer holds the corresponding private key. RFC 6376, key storage
Confirm whether the editor expects a relative label or a complete owner name. DNS master-file conventions include a current origin, but graphical editors are product interfaces and need their own interpretation. The acceptance criterion is the resulting fully qualified owner name, not whether the operator typed a familiar shorthand. RFC 1035, master-file format
Interpret authentication outcomes narrowly
Some introductory provider wording describes DKIM as preventing spam or improving delivery. Do not turn that description into a guarantee. DKIM provides a cryptographic signature and an attributable signing identity; it is not encryption of the message body and does not establish that every business instruction in the message is safe. A valid signature is also distinct from DMARC alignment. RFC 6376, introduction
For the actual sending route, an acceptance review should relate a passing SPF or DKIM identity to the visible author domain. DMARC can pass through either qualifying aligned mechanism. A DNS record existing in isolation does not establish that relationship for a message. Nor does authentication guarantee delivery, bypass recipient filtering, or prove that an account has not been abused. RFC 9989, identifier alignment and scope
Fictional diagnosis: the wrong publication owner
Imagine a fictional association called Cedar Trail Club. Its volunteer obtains a suggested DKIM record from the correct cPanel domain, then copies only the value into a DNS change request. Another operator assumes the record belongs at the root because the request contains no selector owner. This is an invented planning scenario, not a claim about an Afrihost customer or a test performed here.
The reviewer rejects the incomplete request without guessing a selector. The application owner must provide the full generated public record and identify the intended signing route. The DNS operator must confirm the authoritative zone and resulting owner name. The release owner then requires actual message evidence, obtained through an authorized process, before accepting signing and alignment. The corrective lesson is to preserve the relationship between generated context, public key location and message identity rather than treating a pasted value as a complete configuration.
Blank operational acceptance worksheet
This worksheet is a proposal. No cell is prefilled with an invented account result.
- Hosting product, package and domain context: ______
- Authorized cPanel operator and approval reference: ______
- Authoritative DNS provider and zone owner: ______
- Existing SPF policy and legitimate sender inventory: ______
- Suggested SPF value and reviewed merged policy: ______
- Full generated DKIM owner name and public value: ______
- Editor name interpretation and conflict check: ______
- Public record observation, timestamp and scope: ______
- Actual message selector, signing domain and envelope identity: ______
- Authentication and alignment evidence: ______
- Rollback, responsible owner and release decision: ______
Publication and operational holds
Account applicability, current product controls, DNS publication, signing activation and received-message verification remain open. No account was accessed, no suggested record installed, no DNS record created and no test message sent. Human subject-matter review, source applicability, original catalogue evidence, production routes, visual accessibility and owner release are also open. The draft does not replace the catalogue’s required implementation evidence with this fictional diagnosis or with the provider’s instructional success wording.