How to Update DNS Records in Namecheap

Namecheap is a popular domain registrar that provides DNS management through its Advanced DNS panel. Namecheap has a critical toggle between its own DNS service (BasicDNS/PremiumDNS/FreeDNS) and custom nameservers that you need to be aware of before editing records. This guide walks you through adding and editing SPF, DMARC, MTA-STS, and DKIM DNS records for your domain in Namecheap. Each section includes the exact steps, correct field values, and Namecheap-specific details to get your email authentication records configured correctly.

Before you start, verify that your domain is using Namecheap's DNS — not custom nameservers. If your domain points to third-party nameservers, the Advanced DNS panel in Namecheap has no effect on your live DNS.

Accessing Your DNS Zone

1. Sign in to your Namecheap account at namecheap.com.
2. Navigate to Domain List from the left sidebar.
3. Find your domain and click Manage next to it.
4. Click the Advanced DNS tab. This is where you manage all DNS records for your domain.
5. Verify that the Nameservers section (on the Domain tab) is set to Namecheap BasicDNS, Namecheap PremiumDNS, or Namecheap FreeDNS. If it is set to Custom DNS, your records are managed by whichever nameservers are configured, and changes in the Advanced DNS tab will not take effect.

Namecheap displays records in a table format with type, host, value, and TTL columns. To add a new record, click Add New Record at the bottom of the records table. To edit an existing record, click the pencil icon next to it or modify the fields directly.

TXT Records

SPF Record

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses and services are authorized to send email for your domain. Your SPF record is published as a TXT record at the root of your domain.

1. In the Advanced DNS tab, click Add New Record.
2. Select TXT Record from the Type dropdown.
3. In the Host field, enter @. Namecheap uses @ to represent the root of your domain.
4. In the Value field, enter your SPF record: v=spf1 include:_spf.mxio.io ~all
5. Set the TTL to Automatic or 30 min. Namecheap's Automatic TTL is a reasonable default for most records.
6. Click the green checkmark to save the record.

If you already have an SPF record, do not create a second one. Multiple SPF records cause a PermError and break email authentication entirely. Instead, click the pencil icon on the existing TXT record that begins with v=spf1 and add include:_spf.mxio.io before the ~all or -all mechanism.

Namecheap-specific note: Namecheap's default DNS service includes "parking" records and email records that may conflict with your custom configuration. If you see unexpected MX or TXT records that you did not create, they may be part of Namecheap's default setup. Review and remove any records that conflict with your email authentication configuration.

DMARC Record

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers how to handle email that fails SPF and DKIM checks. It also enables aggregate reporting so you can see who is sending email as your domain.

1. Click Add New Record.
2. Select TXT Record from the Type dropdown.
3. In the Host field, enter _dmarc. Namecheap will append your domain, resulting in _dmarc.yourdomain.com.
4. In the Value field, enter your DMARC policy: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
5. Set the TTL to Automatic.
6. Click the green checkmark to save.

Replace dmarc@yourdomain.com with the address where you want to receive DMARC aggregate reports. Start with p=none to collect data before enforcing. See the DMARC Deployment Guide for the full progression from none to quarantine to reject.

Note: mxio will support DMARC policy management in a future release.

CNAME Records

MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending servers that your domain supports TLS encryption for inbound email and that they should refuse to deliver over an unencrypted connection. The MTA-STS policy is published via HTTPS, and a CNAME record points to the policy host.

1. Click Add New Record.
2. Select CNAME Record from the Type dropdown.
3. In the Host field, enter _mta-sts. Namecheap will append your domain automatically.
4. In the Value field, enter the CNAME target provided by your MTA-STS hosting service.
5. Set the TTL to Automatic.
6. Click the green checkmark to save.

You also need a TXT record at _smtp._tls to publish the MTA-STS policy version identifier. Follow the same TXT record process described above, using _smtp._tls as the Host and the policy string as the Value.

Note: mxio will support MTA-STS hosting in a future release.

NS Delegation

DKIM Key Hosting

DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was sent by an authorized server and that the message body was not altered in transit. DKIM keys are published as DNS records under the _domainkey subdomain.

For centralized DKIM key management, you can delegate the _domainkey subdomain to a dedicated DNS host via NS records.

1. Click Add New Record.
2. Select NS Record from the Type dropdown. If NS is not available in the dropdown, Namecheap may require you to use PremiumDNS for custom NS records, or you may need to contact support.
3. In the Host field, enter _domainkey. Namecheap will append your domain, resulting in _domainkey.yourdomain.com.
4. In the Value field, enter the first nameserver provided by your DKIM hosting service.
5. Set the TTL to Automatic.
6. Click the green checkmark to save.
7. Repeat for each additional nameserver (typically 2-4 NS records are required for redundancy).

Note: mxio will support DKIM key hosting via NS delegation in a future release.

Verifying Your Changes

After adding or editing DNS records in Namecheap, verify that your changes are live and correct.

1. Use the mxio SPF Checker to validate your SPF record. Enter your domain and confirm that the record resolves correctly, the lookup count is within the 10-lookup limit, and all your sending services are included.
2. Use the mxio DMARC Checker to verify your DMARC record is published and syntactically correct.
3. Use the mxio Domain Health tool for a full overview of your domain's email authentication status, including SPF, DKIM, DMARC, and MX configuration.
4. If you created NS delegation records for DKIM, use the Delegation Health tool to verify that the NS records are resolving correctly and the delegated zone is responding.

DNS propagation from Namecheap typically takes 5 minutes to 30 minutes when using Namecheap's own DNS service. If your domain recently switched from Custom DNS to Namecheap DNS, full propagation of the nameserver change can take up to 48 hours.

Troubleshooting

Custom DNS vs. Namecheap DNS

The most common issue with Namecheap is having records in the Advanced DNS tab that have no effect because the domain uses custom nameservers. Go to the Domain tab, check the Nameservers section, and verify it is set to Namecheap BasicDNS, PremiumDNS, or FreeDNS. If it is set to Custom DNS, your records must be managed at the custom nameserver provider.

Duplicate SPF records

Your domain must have exactly one SPF TXT record at the root. If you see two TXT records starting with v=spf1, delete one and merge the include mechanisms into a single record. Use the SPF Checker to confirm you have only one record after merging.

Parking page records

Namecheap's BasicDNS includes default "parking" records (typically A records pointing to Namecheap's parking page IP and CNAME records for www). These parking records do not affect TXT or NS records, but they can cause confusion when reviewing your DNS zone. You can safely ignore parking records unless they conflict with records you are trying to create.

Host field format

Namecheap uses @ to represent the root domain. For subdomains, enter only the subdomain portion — Namecheap appends the domain automatically. For example, to create a record at _dmarc.yourdomain.com, enter _dmarc in the Host field.

Record save failures

Namecheap occasionally displays save errors when the value field contains special characters. If a TXT record fails to save, try removing and re-entering the value, paying close attention to semicolons and equal signs. Ensure there are no leading or trailing spaces in the value field.