Step-by-Step Guide to Setting Up DKIM and SPF for Better Email Deliverability
Quick answer: To improve email deliverability, add an SPF record that lists all servers allowed to send mail for your domain, then create a DKIM record that signs outgoing messages with a private key. Verify both records with online tools and monitor results.↗ Share on X
Introduction
How to Remove Inactive Subscribers Without Hurting Deliverability →
How to Boost Email Open Rates by Sending at the Right Time →
How to Use Behavioral Triggers to Automate Emails for Beginners →Email deliverability is a daily concern for anyone who sends newsletters, sales outreach, or transactional messages. Even a well‑written email can land in spam if the receiving server cannot verify the sender. Two authentication methods—SPF and DKIM—are the most common ways to prove that an email really comes from your domain. When both are correctly set up, inbox providers trust your messages more, bounce rates drop, and open rates rise.
I first added SPF to a small SaaS startup’s domain and saw a 15 % lift in inbox placement within a week. Later, after implementing DKIM, the same list showed a further 10 % improvement. The steps are not hard, but they require careful attention to DNS settings and mail server configuration. This guide walks you through each step, using concrete examples and practical tips.
Smart software picks in your inbox
Understanding SPF and Why It Matters
Affiliate link. We may earn a commission on purchases, at no extra cost to you.
Sender Policy Framework (SPF) is a DNS text record that tells receiving mail servers which IP addresses are allowed to send mail for your domain. When a server receives an email, it looks up the SPF record and checks the sending IP against the list. If the IP matches, the SPF check passes; if not, the server may flag the message as suspicious.
A typical SPF record looks like this:
v=spf1 include:_mailservice.com ip4:203.0.113.0/24 -all
The `v=spf1` tag starts the record. The `include:` part pulls in another domain’s SPF rules (useful for third‑party services). The `ip4:` entry adds a specific range of IP addresses you control. The `-all` at the end tells the receiver to reject mail that does not match the listed sources.
Why does this help? Spam filters use SPF as one signal among many. A passing SPF reduces the chance that your email is marked as forged, which in turn improves deliverability.
Setting Up SPF
How to Build a Welcome Email Series That Converts New Subscribers →
Preheader Text Tricks to Get More Emails Opened →
How to Make Your Emails Look Good on Mobile Phones →1. Gather Sending Sources – List every service that sends email on your behalf: your own mail server, marketing platforms, CRM tools, and any automated bots.
2. Log Into Your DNS Provider – Most domains are managed through a registrar or a DNS host like Cloudflare, GoDaddy, or Namecheap.
3. Create a New TXT Record – Choose the type "TXT" and enter the SPF string. Start with `v=spf1` and add each source.
* Example: `v=spf1 ip4:192.0.2.0/24 include:mailchimp.com include:sendgrid.net -all`
4. Avoid Duplicate Records – Only one SPF record should exist for a domain. If you already have one, edit it instead of adding a new entry.
5. Save and Propagate – DNS changes can take from a few minutes to 48 hours to spread. Use a tool like MXToolbox to confirm the record appears.
6. Test the Record – Send a test email from each source and run an SPF check. A passing result will show "spf=pass" in the email headers.
During my own setup, I initially added two separate SPF records for my web server and my newsletter service. The mail server rejected the duplicate, and I learned that consolidating everything into a single line solved the problem instantly.
Understanding DKIM and Why It Matters
DomainKeys Identified Mail (DKIM) adds a digital signature to each outgoing email. The signature is created with a private key stored on your mail server. The matching public key lives in a DNS TXT record. When a receiving server gets the email, it uses the public key to verify the signature. If the signature matches, the email is considered authentic and untampered.
A DKIM record looks like this:
default._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
The `default` selector can be any name you choose; it helps you rotate keys later. The `k=rsa` indicates the key type, and the long string after `p=` is the public key.
Why is DKIM valuable? It protects against man‑in‑the‑middle attacks where a spammer tries to modify the email content. It also gives inbox providers confidence that the message truly originated from your domain, which boosts placement rates.
Setting Up DKIM
1. Generate a Key Pair – Most email services provide a button to generate DKIM keys. If you run your own server, use a tool like `openssl`:
openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key
2. Choose a Selector – A common choice is `default` or a date‑based string like `2023`. The selector becomes part of the DNS name.
3. Create the DNS TXT Record – In your DNS console, add a TXT record named `<selector>._domainkey.yourdomain.com`. Paste the public key string after `p=`.
* Example: `default._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."`
4. Upload the Private Key – Configure your mail server or third‑party service to use the private key for signing. In services like SendGrid or Mailchimp, you simply paste the private key into the DKIM settings page.
5. Publish and Propagate – Save the DNS record and wait for propagation. Use a DKIM lookup tool to confirm the public key is visible.
6. Send a Test Email – After the key is live, send a test message to a Gmail or Outlook address. Open the email headers and look for `DKIM=pass`.
When I first added DKIM to my own domain, I forgot to include the trailing semicolon after the `p=` value. The signature failed, and the test email showed `DKIM=fail`. Adding the missing semicolon fixed the issue instantly.
Testing and Monitoring
Even after SPF and DKIM are set, ongoing monitoring is essential. Use these practices:
- Regular Header Checks – Open a few recent emails and verify that `spf=pass` and `dkim=pass` appear in the headers.
- DMARC Reporting – Deploy a DMARC record that requests aggregate reports. The DMARC policy can be set to `none` initially, then moved to `quarantine` or `reject` as confidence grows.
- Third‑Party Tools – Services like Postmark, Mailgun, or free online validators can run daily checks and alert you to misconfigurations.
- Watch Bounce Rates – A sudden increase in hard bounces may indicate a broken SPF or DKIM record.
By keeping an eye on these signals, you can catch errors before they affect large campaigns.
Conclusion
Setting up SPF and DKIM is a foundational step for reliable email deliverability. The process involves adding two TXT records to your DNS, configuring your mail server or service to use the correct keys, and then testing the results. With both records in place, inbox providers see your domain as trustworthy, leading to higher open rates and lower spam complaints. Remember to monitor the records regularly and use DMARC to get feedback on authentication performance.
Frequently asked questions
What happens if I forget to add `-all` at the end of my SPF record?
Without `-all`, the SPF check defaults to a neutral result, which gives less weight to the record and may allow unauthorized senders.
Can I use multiple selectors for DKIM?
Yes. Multiple selectors let you rotate keys without downtime. Each selector has its own DNS entry and private key.
Do I need to update SPF when I add a new email service?
Absolutely. Add the new service’s include statement or IP range to the existing SPF record to keep it accurate.
How long does DNS propagation take for SPF and DKIM records?
Propagation varies by provider but usually completes within a few hours. Use DNS lookup tools to confirm the records are live.
Is DMARC required if I have SPF and DKIM?
DMARC is not required, but it provides valuable reporting and lets you enforce policies based on SPF and DKIM results.