Source review dated 8 November 2026. Provider settings and acceptance exercises below are documentary guidance, not executed account, DNS or message tests.
Confirm that Krystal handles outgoing mail
Krystal's authentication guide applies to domains using its mail servers. A domain hosted or registered with Krystal may instead use another mail provider, so establish the outgoing route before applying cPanel defaults. Record the domain, hosting account, authoritative DNS provider, mailbox service, website applications and intended From addresses. Krystal authentication scope.
Preserve the existing zone and account settings, and name the person who owns recovery. Include order notifications, password resets and contact forms in the inventory, not just employee mailboxes. A working inbox proves neither the website's sending identity nor the authenticity of mail leaving a separate relay. Plan a controlled change window for any application whose failure would interrupt customer service.
Review cPanel recommendations before installing them
Open cPanel > Email > Email Deliverability and choose Manage beside the domain. Krystal documents the suggested DKIM and SPF records there and an Install the suggested record action for each. Repair restores default records. Review those recommendations against the current authorized senders before using a repair or installation action, particularly where the domain has other services. SPF and DKIM in cPanel.
Capture the complete owner name, type and value for each proposed record. Check whether cPanel controls the authoritative zone. A local record change does not demonstrate that an external DNS provider has published it. When an external zone is involved, use its supported editing process to publish the appropriate values and retain the actual DNS answers. Do not invent a universal selector, public key or Krystal SPF include from another customer's configuration.
Maintain one SPF policy at the relevant owner name, merge approved authorization and review recursive lookup cost. Keep unrelated TXT records intact. Preserve a working selector until its replacement is verified and any required transition is complete. Treat the account's current recommendation as the starting point for review, rather than as evidence that all other sender dependencies can be removed.
Inspect MailChannels and application submission
Krystal documents MailChannels as part of its outgoing-mail service. Its FAQ says rollout can be managed automatically where both hosting and DNS are with Krystal. It also explains that PHP mail can use the cPanel user's server address, causing bounces to reach the default mailbox. This makes website mail an important separate test case. Krystal MailChannels FAQ.
Krystal's WordPress procedure uses authenticated SMTP through a cPanel mailbox and recommends WP Mail SMTP for that setup. Use the actual mailbox connection details from the account, require a correctly validated encrypted connection, review how the application stores credentials and test after configuration changes. Moving a password into wp-config.php does not encrypt it: restrict access, keep backups private and keep the secret out of repositories and shared evidence. Do not treat SMTP login success as proof of domain authentication: the receiver must still verify SPF or DKIM and alignment. The same guide warns that cPanel mail accounts are not intended for mass-email sending. WordPress SMTP setup and usage limits.
For contact forms, keep the customer-supplied address out of the authenticated sender identity unless the sending system explicitly supports and authorizes it. Prefer a controlled organizational From address and test the intended reply behavior separately. Record which application setting selects the envelope sender, where supported; the retrieved sources do not establish a universal custom Return-Path control for all Krystal routes.
Evaluate DMARC using the actual domains
SPF checks the SMTP envelope domain, while DKIM verifies the message signature associated with its d= domain. DMARC compares passing authentication identities with the visible From domain. Either aligned passing path can satisfy DMARC; merely seeing SPF pass for a relay identity is insufficient. Strict and relaxed settings describe domain alignment, not whether every failed signature must be rejected. SPF, DKIM and DMARC.
Krystal exposes DMARC editing through cPanel's Zone Editor. Review the existing record first and avoid duplicate policies. Choose the policy with the domain owner after checking all legitimate senders. Report collection also requires an explicit reporting destination; adding p=none by itself does not create a mailbox or deliver aggregate reports. Keep provider-interface defaults separate from the organization's reviewed policy. Krystal DMARC controls.
Verify messages and preserve a recovery path
Original acceptance worksheet, not an executed test: send harmless messages from a hosted mailbox and every distinct website or application route to controlled external recipients. Preserve original message sources and timestamps. Build a received-message identity table with workflow, visible From domain, Return-Path, receiver SPF identity and result, all DKIM d= and s= pairs, and the trusted receiver's DMARC result. Attach authoritative DNS evidence and test replies and bounce handling separately.
Accept each route only when its intended identity and an aligned passing authentication path are demonstrated. If the mailbox works but the website fails, investigate submission and envelope settings before editing a domain-wide policy. If cPanel reports a local problem, compare its suggested values with live authoritative DNS. Pause the affected application rollout or restore its previously approved settings rather than resetting the whole zone.
No live Krystal account, MailChannels route, authoritative DNS record or received message was tested here. Current account instructions, published-record evidence and the original identity table from each exact route remain mandatory evidence gates. Independent technical review and human SME approval are pending before publication or production approval.