Provider guides
DMARC for Xneelo and hosted email
Work safely with variable DNS, cPanel, Plesk and host-managed mail configurations.
What Xneelo / hosted mail handles
Hosted email may be provided by a hosting account, a separate mail platform or a reseller configuration. The product name alone does not identify the complete sending path.
DNS can be hosted separately from the website and mail service. Confirm authoritative nameservers, actual MX targets and the control panel used before changing a record.
Configure SPF without creating a second record
Use the SPF value documented for the specific hosting environment. Some accounts authorize host-managed servers; others route through a distinct platform. Never infer an include from the hosting brand alone.
A domain must publish one SPF record. If another service already sends mail, merge its authorization into the existing record and evaluate the complete DNS lookup count.
Illustrative structure
v=spf1 include:provider.example include:approved-sender.example -allEnable and confirm DKIM
DKIM availability and selector management depend on the hosting environment. cPanel, Plesk and host-managed platforms expose different controls; obtain the active selector from that system.
Resolve the supplied selector and inspect a message sent through the hosted mailbox. If signing is unavailable, ask the host for the supported authentication path before enforcement.
DKIM is selector-specific. Confirm the selector shown by the provider resolves in public DNS and then send a message to a mailbox where you can inspect Authentication-Results.
Add DMARC on top
DMARC checks whether SPF or DKIM passes and aligns with the domain visible in the From address. Start with reporting while legitimate services are still being identified.
Move to quarantine and reject only after reports show that real senders authenticate correctly. Use pct for a controlled rollout, and review the sp policy when subdomains send mail.
Monitoring example
v=DMARC1; p=none; rua=mailto:[email protected]Enforcement target
v=DMARC1; p=reject; pct=100Account for third-party senders
Website forms, invoicing tools and marketing platforms often bypass hosted mail. Record each source and configure its own aligned authentication path.
- List marketing, invoicing, support, recruitment and transactional systems.
- Confirm whether each service supports aligned DKIM, aligned SPF, or both.
- Use a dedicated subdomain where separation improves control.
- Do not authorize an entire provider when a narrower account-specific option exists.
Typical mistakes
Provider authentication covers that provider, not every system using the same visible From domain.
- Editing DNS in the hosting panel when authoritative DNS is elsewhere
- Assuming all accounts under one hosting brand share mail infrastructure
- Copying a DKIM selector from another domain
- Forgetting website forms and local applications that send independently
Verify the result and keep it healthy
Check DNS from outside the provider dashboard, send representative messages and inspect both SPF and DKIM alignment. Then monitor aggregate DMARC reports as real traffic arrives.
Orillon groups sender evidence into recognizable services, explains failures and guides policy forward without treating a DNS record as proof that mail is protected.
- Confirm authoritative nameservers and MX records first
- Identify whether the account uses cPanel, Plesk or another mail platform
- Send from both a mailbox and the website application
- Review reports long enough to catch low-frequency senders