Although SPF and DKIM work behind the scenes, they play a vital role in helping your emails reach your recipients’ inboxes instead of being marked as spam.
This guide will help you understand how SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) work together to improve email delivery and protect your domain from email spoofing.
By the end of this guide, you’ll understand why these email authentication methods are important, how they affect your domain’s reputation, and what to check to ensure they’re configured correctly.
What This Means
Every time you send an email, the receiving mail server checks whether it can trust the message.
SPF and DKIM are industry-standard email authentication technologies that help verify that emails sent from your domain are legitimate.
SPF (Sender Policy Framework)
This is a DNS record that specifies which mail servers are authorised to send email on behalf of your domain.
If an email is sent from a server that isn’t authorised, receiving mail providers may reject it or mark it as spam.
DKIM (DomainKeys Identified Mail)
DKIM adds a secure digital signature to outgoing emails.
Receiving mail servers verify this signature to confirm that:
- The email genuinely came from your domain.
- The message has not been altered during delivery.
Together, SPF and DKIM help improve email deliverability while protecting your domain from spoofing and phishing attempts.
Steps to Confirm/Update Your SPF and DKIM Records
Step 1: Confirm Where Your Email Is Hosted
Before reviewing your authentication records, identify which service sends email for your domain.
This may be:
- 1-grid Email Hosting
- Microsoft 365
- Google Workspace
- Your own mail server
- A third-party email marketing platform
Different email providers require different SPF and DKIM configurations.
Step 2: Verify Your SPF Record
Your domain should have a valid SPF TXT record in its DNS zone.
A correctly configured SPF record:
- Helps receiving servers verify legitimate mail.
- Improves email delivery.
Important:
A domain should only have one SPF record.
Having multiple SPF records can cause authentication failures. Explore our guides on how to set up or make changes to an SPF record for more guidance on completing this step.
Step 3: Verify Your DKIM Configuration
If your email service supports DKIM, ensure it has been enabled.
Your email provider will typically:
- Generate DKIM keys.
- Provide a DNS TXT record.
- Sign outgoing emails automatically.
Once configured, receiving mail servers can validate the digital signature attached to your emails.
Step 4: Allow DNS Changes to Propagate
If you’ve recently updated your DNS records, the changes may not appear immediately.
DNS propagation can take up to 24 hours.
During this period:
- Some recipients may still see the previous configuration.
- Email authentication results may vary until propagation completes.
Step 5: Test Your Email Authentication
After updating your records:
- Send a test email to another email account.
- Review the email headers using your email provider or an online header analysis tool.
- Confirm that both SPF and DKIM pass authentication.
If authentication fails, review your DNS records and email service configuration.
Important Things to Know
- DKIM verifies that your email hasn’t been modified after being sent.
- Both technologies work together to improve email deliverability.
- SPF and DKIM do not encrypt your emails.
- DNS changes may take up to 24 hours to propagate.
- Your SPF and DKIM records must match the service sending your email.
- If you change email providers, you may also need to update your authentication records.
Before You Move On
Before assuming everything is working correctly:
- Confirm your SPF record exists.
- Verify DKIM is enabled.
- Ensure only one SPF record exists.
- Check that your email service matches your DNS records.
- Allow sufficient time for DNS propagation.
- Send a few test emails to verify successful delivery.
Common Mistakes to Avoid
- Creating multiple SPF records for the same domain.
- Forgetting to update SPF when changing email providers.
- Assuming DKIM is enabled automatically for every email service.
- Testing email delivery immediately after updating DNS records.
- Ignoring authentication failures because email still appears to send successfully.
If This Didn’t Work
If your emails continue to fail authentication or are delivered to spam folders, gather the following before contacting support:
- Your domain name.
- The email address you’re sending from.
- The recipient email address used for testing.
- The full email headers (if available).
- Screenshots of your DNS records.
- Any error or bounce-back messages received.
This information helps our support team diagnose authentication or DNS issues more efficiently.
Related Articles
- Understanding DNS Records and How To Check These
- Adding a DMARC Record in cPanel
- How to Troubleshoot Email Delivery Issues
- How to Update DNS Records for Your Domain
- SMTP Error 535: Authentication Failed (How to Fix It)
FAQs
What is SPF?
SPF is a DNS record that tells receiving mail servers which servers are authorised to send email for your domain.
What is DKIM?
DKIM adds a digital signature to outgoing emails so recipients can verify that the message is authentic and hasn’t been modified.
Do I need both SPF and DKIM?
Yes. Using both provides stronger email authentication and significantly improves email deliverability.
Can I have more than one SPF record?
No. A domain should only have one SPF record. If multiple records exist, email authentication may fail.
Why are my emails still going to spam after enabling SPF and DKIM?
Spam filtering considers many factors, including your domain reputation, email content, sending behaviour, and whether other authentication methods, such as DMARC, are configured correctly.
How long do DNS changes take?
DNS updates can take up to 24 hours to propagate across the internet.
Empowering Insight
Email authentication is one of the most effective ways to improve email deliverability. Ensuring your SPF and DKIM records are correctly configured helps protect your domain’s reputation and increases the likelihood that your emails will reach your recipients’ inboxes.
Need Additional Support?
If you’ve reviewed the steps above and your emails are still failing authentication or being marked as spam, consult the related articles first and explore our other email-related articles.
If you still need assistance, contact us with your domain name, DNS records, and any error messages so our Support Team can investigate further.