[ Sending-service guides ]

Authenticate email sent through Krystal: configuration and verification

Configure Krystal cPanel mail authentication and inspect the actual MailChannels or application route before accepting SPF and DKIM alignment.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Review cPanel recommendations before restoring defaults.
  • Treat WordPress SMTP and mailbox routes as separate acceptance cases.
  • Protect credentials and verify receiver alignment.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Protect credentials and verify receiver alignment.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Review before repairing

cPanel defaults may not include every legitimate sender already authorized by the domain.

Next steps

  1. Compare suggested and current records.
  2. Publish at the authoritative DNS provider.
  3. Test mailbox and application messages separately.

CISO / SecOps

Separate authentication from delivery

An authenticated SMTP session or a relay acceptance does not establish aligned mail at the receiver.

Next steps

  1. Inspect actual From and envelope domains.
  2. Review application credential storage.
  3. Approve enforcement and report destinations separately.

Founder / Non-technical

Keep customer notifications working

Website mail can follow a different route from the business mailbox.

Next steps

  1. Inventory forms and transactional notifications.
  2. Retain a recovery owner.
  3. Require controlled delivery and reply tests.

[ FAQs ]

Frequently asked questions

Does this setup apply if I use Microsoft 365 or another mail provider?

Krystal scopes the guide to its own mail servers. Use the actual mail provider’s authentication instructions for another route.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Where are Krystal’s suggested SPF and DKIM records?

In cPanel under Email Deliverability > Manage for the selected domain.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I click Repair whenever authentication fails?

Review first. Repair restores defaults and may not preserve the authorization needed by other services.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What if authoritative DNS is outside cPanel?

Publish the reviewed records through that DNS provider and verify its answers. A local cPanel entry alone is not sufficient evidence.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why do website bounces reach the default mailbox?

Krystal explains that PHP mail may use the cPanel user’s server address, which directs bounces to that mailbox.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does switching WordPress to SMTP complete DMARC setup?

No. It changes submission. Verify the delivered SPF and DKIM identities and their alignment with From.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I use the cPanel mailbox for bulk campaigns?

Krystal’s WordPress mail guide warns that these mailboxes are not intended for mass-email sending. Use a suitable approved service for that workload.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What remains before approval?

Live account settings, authoritative records, original received-message identity tables and independent technical and human SME review remain pending.

Improving mail deliverability with SPF, DKIM and DMARC MailChannels FAQ Using SMTP to send emails from WordPress RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Improving mail deliverability with SPF, DKIM and DMARC

    Sections Scope15; records16–21; DMARC22–40; alignment definitions32–33 corrected against RFC9989

  2. MailChannels FAQ

    Sections Rollout13–14; PHP bounce26–28

  3. Using SMTP to send emails from WordPress

    Sections SMTP/mailbox10–28; credential storage30–47; mass mailing50

  4. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Email Deliverability
The cPanel area displaying domain authentication status and suggested records.
Default mailbox
The cPanel mailbox that can receive mail addressed to the account user, including some PHP-mail bounces.
SMTP submission
The application or client’s handoff of a message to an outgoing mail service.
MailChannels
The outgoing relay service described in Krystal’s hosting documentation.
Aligned authentication
A passing SPF or DKIM result whose authenticated domain meets DMARC’s relationship to the From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base