WHMCS emails going to spam cost you more than you’d think. Clients miss invoices and pay late. Password resets never arrive, so they open a ticket instead. New customers don’t see their welcome email with their login details. The good news is that the cause is usually the same handful of DNS records, and you can fix them in an afternoon. This guide explains how mailboxes decide where your mail lands, and the easy SPF, DKIM and DMARC fixes that stop WHMCS emails going to spam for good.
Why Are My WHMCS Emails Going to Spam?
Gmail, Outlook and Yahoo all ask the same question about every message: can I prove this email really came from the domain in the From line? When you find WHMCS emails going to spam, it’s almost always because they failed that test for one of these reasons:
- No SPF record, or one that doesn’t list the server WHMCS actually sends from.
- No DKIM signing, so the message can’t prove it wasn’t changed on the way.
- No DMARC record, which major mailbox providers increasingly expect from anyone sending business email.
- A From address on a different domain than the one your server is set up to send for.
- A blacklisted server IP, common on shared servers where another account sent spam.
Google’s email sender guidelines spell out what Gmail expects, and SPF, DKIM and DMARC are at the top of the list.
What It Costs You When Mail Lands in Spam
It’s easy to treat deliverability as a technical detail, but WHMCS emails going to spam hit your business directly. Unseen invoices turn into late payments and avoidable suspensions. Missed welcome emails make a brand-new customer’s first experience a support ticket. And once a mailbox provider decides your domain looks suspicious, even your manual replies start landing in junk. Stopping WHMCS emails going to spam protects your cash flow and your reputation at the same time.
A Quick Checklist
- One SPF record that lists every server and service sending for your domain.
- DKIM switched on for the domain in your WHMCS From address.
- A DMARC record, starting at
p=none. - SPF and DMARC on your server hostname’s own DNS zone, if it has one.
- A clean blacklist check for your sending IP.
Tick all five and you’ve dealt with the causes behind most WHMCS emails going to spam. The steps below walk through each one.
Step 1: Know How WHMCS Sends Mail
Before touching DNS, check which mail provider WHMCS uses. Go to Configuration → System Settings → General Settings and open the Mail tab. WHMCS supports PHP Mail, SMTP, Google, Microsoft, Mailgun, SendGrid and SparkPost.
This matters because SPF and DKIM have to match whoever actually sends the message:
- PHP Mail sends from your own server. Your server’s IP must be in SPF, and your server must sign with DKIM.
- SMTP to your own cPanel mailbox also sends from your server, with the same requirements, but it’s usually more reliable than PHP Mail.
- Google, Microsoft or a sending service sends from that provider. Their servers go in SPF, and you add the DKIM record they give you.
Also check the System Emails From Email address on the same tab. It should be an address on the domain you’re about to set records for, like billing@yourdomain.com. A mismatched From address is one of the quietest causes of WHMCS emails going to spam.
Step 2: Set Up SPF
SPF is a TXT record that lists the servers allowed to send email for your domain. A typical record for a domain that sends from one server looks like this:
v=spf1 +a +mx +ip4:203.0.113.10 ~allReplace the IP with your server’s. If you also send through Google or another service, add their include, such as include:_spf.google.com. A few rules keep SPF healthy:
- Only one SPF record per domain. Two records cause both to fail. Merge them into one.
- Stay under 10 DNS lookups. Every
include,aandmxcounts. Going over makes SPF fail. - Choose an ending.
~all(soft fail) is a safe start. Move to-all(hard fail) once you’re sure every sender is listed.
A broken SPF record is worse than none at all, so double-check the syntax. Stray quotes or a second record are behind plenty of WHMCS emails going to spam.
On cPanel, the Email Deliverability tool shows whether SPF and DKIM are valid for each domain and can install suggested records for you.
Step 3: Turn On DKIM
DKIM adds a digital signature to every message, and a public key in your DNS lets mailboxes check it. If WHMCS sends from a cPanel server, DKIM is usually a single click in cPanel’s Email Deliverability tool, or enabled for every account at once in WHM. If you use Google, Microsoft or a sending service, they’ll give you a DKIM record to add, usually under a name like google._domainkey. Without DKIM, a forwarded or relayed message has no way to prove it’s genuine, which is why missing signatures so often leave WHMCS emails going to spam.
Step 4: Add a DMARC Record
DMARC ties SPF and DKIM together. It tells mailboxes what to do when a message fails, and where to send reports. It’s a TXT record at _dmarc.yourdomain.com. Start gently:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=none means “just report, don’t block.” Watch the reports for a couple of weeks to make sure your WHMCS mail passes, then tighten to p=quarantine and finally p=reject, which tells mailboxes to refuse anything that fails. That stops anyone from sending fake invoices that look like they came from you, which is a real risk for any business that bills online. The DMARC.org overview explains each tag if you want to go deeper.
Don’t Forget Your Server Hostname
This is the step most guides skip, and we ran into it ourselves. Your server has a hostname, such as server.yourdomain.com, and some system mail goes out under it. On a cPanel server, the hostname often has its own DNS zone, separate from your main domain’s zone.
That catches people out. We added an SPF record for our hostname inside our main domain’s zone, and it never showed up in public DNS. The hostname’s own zone was answering instead and quietly overriding it. Once we added the SPF record to the hostname’s zone, it went live within minutes. If your hostname has a separate zone in WHM’s DNS Zone Manager, put its SPF and DMARC records there.
For DMARC, the sp= tag on your main domain’s record sets the policy for subdomains. With sp=reject, subdomains like your hostname are covered even without their own record. Adding one anyway does no harm and makes checking tools show a clean pass.
Step 5: Test Before You Call It Fixed
- Send a test from the Mail tab in WHMCS to a Gmail address you control.
- In Gmail, open the message, click the three dots and choose Show original. You want to see PASS next to SPF, DKIM and DMARC.
- For a full report, send a message to mail-tester.com and aim for a 10/10 score.
- Check your server’s IP with a blacklist checker. If it’s listed on a shared server, ask your host about it.
If every check passes and you still see WHMCS emails going to spam at one provider, give it a few days. Mailbox providers build trust over time, and a clean record from here on usually clears it up.
Our list of free web hosting tools includes SPF and DNS checkers you can bookmark. To let your clients run the same checks on their own domains from inside your client area, our Caddie WHMCS tools addon includes an Email Deliverability Checker, an SPF and DMARC Record Builder with the 10-lookup check, and a DMARC Report Analyzer.
Other Ways to Stop WHMCS Emails Going to Spam
- Use SMTP instead of PHP Mail. It gives you proper authentication and clearer errors when something fails.
- Keep templates simple. Heavy images, link shorteners and all-caps subjects all add to a spam score, and they can leave WHMCS emails going to spam even when DNS is perfect.
- Set reverse DNS. Your server IP’s PTR record should point back to its hostname. Your host sets this.
- Keep WHMCS secure. A compromised install can be used to send spam and get your IP blacklisted. See our WHMCS security steps.
- Keep the cron running. Invoice and reminder emails depend on the WHMCS cron job, so a stopped cron can look like a delivery problem.
Frequently Asked Questions
Why do I keep finding WHMCS emails going to spam?
Usually because SPF, DKIM or DMARC is missing or doesn’t match the server WHMCS sends from. A blacklisted server IP is the next most common cause.
Should WHMCS use PHP Mail or SMTP?
SMTP or a dedicated provider is usually more reliable. Whichever you pick, SPF and DKIM must match it.
Can a shared server cause WHMCS emails going to spam?
Yes. If another account on the same IP sends spam, the whole IP can be blacklisted. Ask your host to check, or send through a dedicated mail provider.
Is p=reject safe for DMARC?
Yes, once reports show all your real mail passing. Start at p=none, then move up.
Do I need SPF for my server hostname?
It’s a good idea, because system mail can go out under the hostname. If the hostname has its own DNS zone, add the record there.
How long do DNS changes take?
Usually minutes, though some records take up to a few hours to show everywhere. Test again after an hour if a checker still shows the old value.
Hosting That Gets Email Right
Every account on our reseller hosting and shared hosting plans comes with SPF and DKIM set up, and we’re happy to help with DMARC. If you’re setting up WHMCS for reseller hosting or looking to reduce support tickets in WHMCS, good email is where it starts. Browse our WHMCS addons, or get in touch if you still have WHMCS emails going to spam after these steps.
