DKIM and SPF: authenticate your emails and stay out of spam

By Mouhamed BANKOLE, CEO at ITNET Technologies · Updated October 27, 2026 · Reading time: 9 min

Your quotes land in your customers' spam folders, or a supplier asks "is your DKIM set up?" and you are not sure what to answer. In both cases, the problem almost always comes down to email authentication. This guide explains what DKIM and SPF are, why Gmail and other mailbox providers now require them, how to publish the DNS records step by step and how to check that they work. You will also learn to spot the mistakes that make them fail silently.

In short

• DKIM signs every email you send with a private key; the recipient checks the signature using the public key published in your domain's DNS.
• SPF lists the servers allowed to send email for your domain, in a TXT record in the DNS.
• Gmail requires at least one of the two from every sender, and both, plus DMARC, from bulk senders.
• Setting them up takes two DNS records: an SPF TXT at the root of the domain and a DKIM TXT under a selector provided by your email service.
• A free test is enough to check: the header of a received email shows "spf=pass" and "dkim=pass" when everything works.

Contents

1. What is DKIM?
2. What is SPF and how does it differ from DKIM?
3. Why have DKIM and SPF become essential?
4. How does a DKIM signature work?
5. How do you create a correct SPF record?
6. How do you enable DKIM on your domain?
7. How do you test DKIM and SPF?
8. Which mistakes make SPF or DKIM fail?
9. Are DKIM and SPF enough to stay out of spam?

What is DKIM?

DKIM (DomainKeys Identified Mail) is an authentication method that adds a digital signature to every email, which can be checked with a public key published in the sending domain's DNS. It is defined by the IETF in RFC 6376.

In practice, DKIM gives the recipient two guarantees:

• origin: the message was signed by a server allowed to use your domain;
• integrity: the signed content was not altered in transit.

DKIM does not encrypt the message and says nothing about its content: it only proves who signed it and that it is intact. That is what lets mailbox providers trust your domain, and reject the emails that spoof it more easily.

What is SPF and how does it differ from DKIM?

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email on behalf of your domain; it checks the sending server, while DKIM checks the message itself. SPF is described in RFC 7208.

In practice the two complement each other: SPF often fails when a message is forwarded by another server, and DKIM survives that case. DMARC, which relies on both, deserves a guide of its own.

Why have DKIM and SPF become essential?

Because the major mailbox providers require them: since February 1, 2024, Gmail has asked every sender to personal accounts to set up SPF or DKIM, according to its email sender guidelines. Without authentication, your emails may be filed as spam, or even rejected.

What these guidelines require, according to Google's official page:

• for all senders: SPF or DKIM, a TLS connection and a spam rate kept below 0.3% in Postmaster Tools (Google guidelines);
• for those who send more than 5,000 messages a day to Gmail: SPF and DKIM, plus DMARC, and a "From" domain aligned with one of them (Google guidelines);
• a DKIM key of at least 1,024 bits, with 2,048 bits recommended (Google guidelines).

Even a small business sending a few dozen quotes a day falls under the first set of rules.

How does a DKIM signature work?

The sending server computes a hash of the message headers and body, encrypts it with a private key and adds it in a "DKIM-Signature" header; the recipient fetches the public key from the DNS and checks that the hash matches.

The steps, in order:

1. your email service generates a key pair and keeps the private key;
2. you publish the public key in the DNS, under a name such as selector._domainkey.yourdomain.com;
3. on every send, the server signs the message and states the domain (d=) and the selector (s=) used;
4. the receiving server reads these two values, queries the DNS and checks the signature;
5. the result ("pass" or "fail") is recorded in the "Authentication-Results" header of the received message.

The selector lets one domain hold several keys: one for your mailbox provider, one for your email marketing tool, one for your CRM.

Pro tip: every service that sends email with your domain (newsletter, invoicing, website form) must sign with its own DKIM key. List them all before you start: forgetting one is the most common mistake.

How do you create a correct SPF record?

An SPF record is a single TXT, published at the root of the domain, that starts with v=spf1, lists the allowed sources and ends with a rule for everything else, as set out in RFC 7208.

To build it:

• one SPF record per domain: two TXT records starting with v=spf1 make SPF invalid;
• list every sending service with the include: mechanism given in its documentation (your mailbox provider, your email marketing tool…);
• add your own servers with ip4: or a: if your website sends email itself;
• end with ~all (soft fail) during testing, then with -all (reject) once everything is validated;
• watch the number of DNS lookups: RFC 7208 caps at 10 the mechanisms that trigger a DNS query, and beyond that SPF returns an error.

A minimal record looks like this: v=spf1 include:<your email provider's domain> ~all (syntax defined by RFC 7208).

How do you enable DKIM on your domain?

To enable DKIM, you generate the key in your email service, publish the public key in your domain's DNS, then turn on signing in the email service once the record is visible.

The steps:

1. in your email service's admin panel, find the "Authentication" or "DKIM" section and generate a key (2,048 bits if you are given the choice);
2. copy the record name (with its selector) and its value, which starts with v=DKIM1;
3. create the matching TXT record in your domain's DNS zone;
4. wait until the record is visible, then turn on signing in the email service;
5. send a test email and check the result (next section).

At Wayhost, the DNS management included with a domain name lets you create these TXT records, and the Wayhost professional email covers SPF, DKIM and DMARC in its FAQ (observed on October 27, 2026 on the domain name and professional email pages).

If your website sends email itself (forms, orders), remember to authenticate it too: it is often the forgotten piece of web hosting setups.

How do you test DKIM and SPF?

The most reliable test is to send an email to a Gmail inbox and show the original: the "Authentication-Results" header reads "spf=pass" and "dkim=pass" when everything is correct.

Three ways to check:

• the original message: in Gmail, "Show original" summarises SPF, DKIM and DMARC at the top of the page;
• an online checker: enter your domain and selector to read the published DKIM record and check its syntax;
• a DNS query: dig TXT yourdomain.com shows the SPF record, dig TXT selector._domainkey.yourdomain.com the DKIM key.

Run this test again whenever you add a sending service or change email provider.

Which mistakes make SPF or DKIM fail?

Failures almost always come from a DNS publishing error or a forgotten sending service, rarely from the email service itself.

The most common mistakes:

• two SPF records on the same domain instead of one;
• too many includes in SPF, exceeding the DNS lookup limit;
• a truncated DKIM key after copy and paste (long keys are sometimes split into several strings);
• a mistyped selector: the record name does not match the s= value in the signature;
• an undeclared sending service: the newsletter goes out with your domain without being authorised;
• a footer added after signing by an intermediate tool, which breaks DKIM.

Pro tip: when you change email provider, publish the new SPF and the new DKIM key before switching the MX records. Both configurations can coexist for a few days without trouble.

To understand where these records live and who manages them, our domain name guide explains the role of the DNS zone.

Are DKIM and SPF enough to stay out of spam?

No: DKIM and SPF are the baseline, but deliverability also depends on DMARC, domain reputation and message content.

What matters on top of authentication:

• DMARC, which tells mailbox providers what to do with an unauthenticated message and sends you reports;
• the reputation of your domain and servers, built through regular sending without complaints;
• content: no dubious shortened links, an honest subject line, real text and not just an image;
• one-click unsubscribe for marketing emails;
• an address in your own name rather than a free one, as our professional email guide explains.

Frequently asked questions

What is DKIM in a nutshell?

DKIM is a digital signature added to every email sent with your domain. The recipient checks it with a public key published in your DNS. It proves that the message really comes from you and has not been altered.

What is the difference between SPF and DKIM?

SPF checks that the server sending the email is authorised by your domain. DKIM checks the signature of the message itself. They complement each other, because SPF often fails after forwarding while DKIM survives it.

Do you need SPF and DKIM to send email to Gmail?

Gmail requires at least one of the two from every sender to personal accounts. Bulk senders must set up both, plus DMARC. Either way, setting up both is the best protection for your emails.

How do I know if my DKIM is working?

Send an email to a Gmail inbox and show the original message. The DKIM line should read "PASS" with your domain. An online checker can also verify the key published in the DNS.

Can a domain have several SPF records?

No, a domain must have only one SPF record. Two records starting with "v=spf1" make SPF invalid. All allowed services must be combined in the same record.

Can a domain have several DKIM keys?

Yes, thanks to selectors: each key is published under a different name. You usually use one key per sending service, for example your mailbox provider and your newsletter tool. The recipient knows which key to read from the selector given in the signature.

What if my emails still go to spam with SPF and DKIM?

First check that both show "pass" in the original of a received message. Then add DMARC and review your domain reputation and your message content. An undeclared sending service is also a frequent cause.

Should you rotate your DKIM key regularly?

It is good security practice, especially if the key is old or short. Rotation means publishing a new key under a new selector, then switching the signature. The old key can be removed a few days later.

Key takeaways

• DKIM signs your emails and proves they come from your domain without being altered.
• SPF declares your sending servers in a single record at the root of the domain.
• Gmail requires authentication from every sender, with stricter rules for bulk senders.
• Two DNS records are enough to get started, checked in the original of a test email.
• DMARC, reputation and content complete authentication to stay out of spam for good.

To send email in your own name with a clean setup, explore the Wayhost professional email offer.

Article written by Mouhamed BANKOLE, CEO at ITNET Technologies.