Source review dated 8 November 2026. Provider settings and acceptance exercises below are documentary guidance, not executed account, DNS or message tests.
Establish which service sends the message
This guide covers email hosted in HostGator cPanel. Owning a HostGator website or registering a domain there does not establish that HostGator sends its mail. Begin with a specific mailbox and the application that submits messages from it. Record the hosting package, domain, outbound server, current DNS provider and responsible administrator. If a website form sends through a separate email platform, give that route its own authentication change rather than assuming the mailbox configuration covers it.
HostGator says SPF and DKIM are enabled by default for cPanel accounts, but externally hosted DNS may need manual publication. Its instructions explicitly exclude third-party mailbox hosting. Open cPanel > Email > Email Deliverability, select the domain and review its status. Manage exposes the records; the documented repair branch can generate a local DKIM key when problems exist. Copy the actual account values rather than a sample key. HostGator cPanel authentication
Publish the public key rather than the message signature
HostGator's third-party DNS page includes an unsafe instruction to copy the DKIM-Signature header into DNS. Do not follow that step. The message header contains signature data; the selector DNS record contains the public verification key. Use the Name and Value under cPanel's Suggested DKIM TXT record, as the provider's SPF/Deliverability guide describes. Do not copy the separate View the Private Key output into DNS, screenshots or tickets. RFC 6376 sections 3.5 and 3.6 distinguish the signature and key record. DKIM specification cPanel public-record fields
A repair action can be unavailable when the local server does not control authoritative DNS. That does not require moving the nameservers: hand the reviewed public record to the current DNS administrator. Verify the result at the selector named by the real signature, and preserve the old public key if queued messages may still need it.
Reconcile the live DNS zone
Before saving, export the relevant existing records and identify the authoritative nameservers. A local cPanel zone can look complete while public queries reach another DNS provider. Write down the intended fully qualified owner of each record, its type, current value and proposed replacement. Check how the DNS editor treats relative names and trailing dots. A public key published under a duplicated domain name cannot verify the intended signature.
HostGator provides both automatic and manual SPF configuration instructions. Treat that as a starting configuration, not evidence that every subsequent application sender is authorized. Compare the existing policy with the account’s current recommendation. HostGator SPF configuration
Maintain one SPF policy at each owner. Incorporate the approved HostGator authorization into the existing policy without removing other necessary senders. Check the complete evaluation path, including nested includes, against RFC 7208 §4.6.4: ten evaluated DNS-causing terms including nested evaluations, not ten packets or ten visible include entries. Do not solve an SPF error by copying arbitrary server IPs from an old tutorial. Where the value differs from an established working configuration, ask the hosting administrator to explain the change before replacing it.
Verify the sender rather than only the dashboard
Original acceptance plan: send a harmless message from webmail to a controlled external mailbox, then send from the normal desktop or mobile client. If the website uses the same infrastructure, exercise one synthetic form submission separately. For each route, retain the timestamp, visible From address, envelope-sender domain, all DKIM signing domains and selectors, and the receiving system’s authentication results. Do not publish private message contents in a troubleshooting ticket.
SPF passing for the envelope domain is different from DMARC alignment with the visible From domain. A valid DKIM signature can satisfy DMARC when its signing domain aligns, even when SPF is not aligned. Compare the identifiers under the domain’s actual alignment settings. A green cPanel status is not a substitute for this received-message evidence, and successful authentication does not promise inbox placement.
Illustrative failure: webmail passes but a website notification fails. Compare the notification’s actual submission route and From address before regenerating a mailbox key. It may be taking a separate route. Conversely, a missing public DKIM answer after a nameserver change points first toward record migration, not a universal HostGator outage.
Preserve a recoverable change
Keep MX routing outside this change unless mailbox migration is separately intended. Save the original SPF policy and signing record; note which public key corresponds to the active signer before changing keys. If a new route fails, pause that route or restore the last approved working configuration. Do not delete unrelated selectors or weaken DMARC globally to hide one failing application. Close the change only after the intended routes pass their acceptance checks and a named owner has the evidence.
Documentation was reviewed on 8 November 2026. No HostGator account, DNS zone or delivered message was tested. The acceptance plan and failure example are original operational guidance.
HostGator route acceptance worksheet
This is a proposed evidence sheet, not a completed test. Leave unobserved results pending.
- Account, exact mail product, mailbox and application owner: ____.
- Authoritative DNS provider and preserved before-change answers: ____.
- Active signer mode, signing domain, selector and issued public record: ____.
- SPF envelope domain, single merged policy and evaluated-term assessment: ____.
- Public owner/type/value, query timestamp and resolver: ____.
- Received message, actual From, envelope, DKIM results and trusted DMARC result: ____.
- Separate website/client cases, rollback trigger and approving owner: ____.
Publication remains subject to live evidence, visual inspection and human SME/owner approval. No worksheet row is prefilled with a pass.