A customer orders something, WooCommerce sends the confirmation, and it lands in Gmail's spam folder. The site owner assumes the hosting is bad. It almost never is.
Gmail, Outlook and Yahoo now expect every domain to prove that mail claiming to come from it is genuine. If your domain cannot prove that, your mail is suspicious by default — no matter which server sends it.
The three records, in plain terms
SPF lists which servers are allowed to send mail for your domain. Without it, anyone can claim to be you, so receivers treat everything cautiously.
DKIM signs each message cryptographically. The receiver checks the signature against a key published in your DNS, which proves the message really came from you and was not altered on the way.
DMARC tells receivers what to do when SPF or DKIM fails — ignore it, quarantine it, or reject it — and where to send reports.
You need all three. Two out of three still gets you filtered.
Setting them up in cPanel
Modern cPanel does nearly all of this for you. Open Email Deliverability. Any domain with a problem is flagged, and there is a Repair button that generates the correct SPF and DKIM records.
If your DNS is managed at your host, cPanel writes the records itself and you are done. If your nameservers point at Cloudflare or your registrar, cPanel shows you the exact records and you paste them there instead. That is the step people miss — cPanel says "repair", it looks successful, but the records were never added where the domain actually resolves.
DMARC, carefully
cPanel does not always add DMARC, and this is the one people break. Add a TXT record at _dmarc.yourdomain.com and start permissive:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com
p=none means "do not change delivery, just send me reports". Run that for a couple of weeks and read what arrives. Only once you are sure every legitimate sender passes should you move to p=quarantine and later p=reject.
Going straight to p=reject is how people silently destroy their own mail — including anything sent through a newsletter tool or CRM that was never listed in SPF.
Then check it
Send a message to a Gmail address, open it, and use "Show original". You want to see PASS beside SPF, DKIM and DMARC. Anything else tells you exactly which record to go back to.
The one thing records cannot fix
If you are sending bulk mail — a newsletter to 5,000 people — do not send it from your hosting account, however well configured. Shared servers are not built for it and the IP reputation is not yours to control. Use a proper sending service and keep your hosting for transactional mail: order confirmations, password resets, contact forms.