Set up SPF, DKIM, and DMARC on Bluehost
Add SPF, DKIM, and DMARC as TXT records in Bluehost's "Manage Advanced DNS Records" area under Domains → DNS (or the cPanel Zone Editor on legacy/cPanel plans), using "@" for the root and "_dmarc" / "selector._domainkey" for the host (the "Refers to" field).
Where to add records on Bluehost
Bluehost Account Manager (current portal): log in at bluehost.com / my.bluehost.com → Domains (left sidebar) → select your domain (if you have more than one, click the domain name or its Manage/Settings control to open the domain management panel) → DNS tab → you land in "Manage Advanced DNS Records." Legacy/cPanel plans instead: Hosting → cPanel → Domains section → Zone Editor → Manage next to the domain. This only edits live records when the domain actually uses Bluehost's nameservers (ns1.bluehost.com / ns2.bluehost.com); if the nameservers point elsewhere, edit DNS at that provider instead.
- Log in to the Bluehost Account Manager, click Domains in the left menu, then select your domain (click the domain, or its Manage/Settings control) and open the DNS tab.
- In the 'Manage Advanced DNS Records' section, click the '+ Add record' button (top right), then choose 'Single record'.
- Set the Type dropdown to TXT.
- In the host field (the current portal labels it 'Refers to'; older/cPanel screens call it 'Host Record' or 'Name'), enter '@' for the root domain, '_dmarc' for DMARC, or your DKIM selector like 'default._domainkey' (Bluehost appends your domain automatically — do not type the full domain).
- Paste the record string into the 'TXT Value' field (e.g. 'v=spf1 include:_spf.google.com ~all'), and leave/select TTL (default '4 Hours' / 14400s is fine).
- Click 'Add' to create the record, then allow time for propagation before verifying.
The three records on Bluehost
SPF Sender Policy Framework
SPF goes in a TXT record with the host field set to '@' (Bluehost shows it as 'Refers to: @'). Critical gotcha: Bluehost auto-creates a default SPF record for every domain — typically 'v=spf1 a mx include:bluehost.com ~all' (legacy accounts) or 'v=spf1 a mx include:spf.websitewelcome.com ~all' (newer/Rock accounts). A domain may have only ONE SPF record — delete or edit the existing one rather than adding a second, or mail will fail SPF. If you send via Bluehost AND another service, merge into one record (e.g. 'v=spf1 a mx include:_spf.google.com include:spf.websitewelcome.com ~all').
DKIM DomainKeys Identified Mail
Bluehost does not generate DKIM for external senders — your email provider (Google Workspace, Microsoft 365, etc.) gives you the selector and public key. Add it as a TXT record where the host ('Refers to') is the selector plus '._domainkey' (e.g. 'google._domainkey' or 'selector1._domainkey'); Bluehost appends the domain. Paste the full 'v=DKIM1; k=rsa; p=...' value. DKIM keys (especially 2048-bit) exceed 255 characters — paste the whole value in one field and let Bluehost handle it; if the portal rejects the value as too long, use the cPanel Zone Editor, which splits long TXT strings into quoted 255-char chunks automatically.
DMARC reporting and policy
Add a TXT record with the host ('Refers to') field set to exactly '_dmarc' (not '_dmarc.yourdomain.com' — Bluehost appends the domain). Start with a monitoring policy: 'v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com'. Only one _dmarc TXT record may exist. After reviewing reports and confirming SPF+DKIM align, tighten to p=quarantine then p=reject.
Need the record values? Generate a valid SPF and DMARC record with the record generator, then learn what each one does: SPF, DKIM, DMARC.
Bluehost gotchas
- Two different UIs depending on plan: the modern Bluehost Account Manager ('Manage Advanced DNS Records' under Domains → DNS) vs. legacy cPanel Zone Editor (Hosting → cPanel → Domains → Zone Editor). The field labels differ ('Refers to' in the portal vs. 'Host Record' / 'Name' in cPanel), but both want '@' for root and a bare prefix like '_dmarc' — never the full FQDN.
- Editing in the DNS tab does nothing if the domain isn't using Bluehost nameservers (ns1/ns2.bluehost.com). If you registered elsewhere or pointed nameservers to another host, the authoritative DNS lives there, not at Bluehost.
- Bluehost pre-populates a default SPF record (include:bluehost.com on legacy, include:spf.websitewelcome.com on newer/Rock accounts). Adding a second 'v=spf1' TXT record breaks SPF (only one allowed) — edit/delete the existing one and merge includes instead.
- TTL defaults to '4 Hours' (14400s); propagation can take up to 24–48 hours (usually much faster). Don't conclude a record is wrong until it has propagated — verify with an external checker (MXToolbox / dig) rather than trusting the panel immediately. Long DKIM values may need the cPanel Zone Editor if the portal field rejects them; avoid manually adding surrounding quotes since the panel stores the value as-is.
Records set. Now make sure you actually land.
SPF, DKIM, and DMARC on Bluehost get you authenticated, but inbox placement also needs sender reputation and domain warmup. Scheduler Zero handles both so your cold email reaches the inbox.