SPF and DKIM: what they authenticate and where to set them up

Reviewed on September 8, 2026 2 min read spf dkim entregabilidad

SPF checks whether a server may send for the domain used in the message's technical sender. DKIM verifies a signature from the sending domain and the integrity of the signed parts. Neither of them proves on its own who the person is, nor guarantees that the message will reach the inbox.

Mechanism	What you need to check
SPF	That the real server is authorised in a single SPF TXT record for the domain being evaluated
DKIM	That the sender signs and publishes the public key for the selector used
DMARC	That SPF or DKIM passes and its domain is aligned with the visible sender

Where to review the configuration

In cPanel, the old Authentication option has been replaced by Email Deliverability. Click Manage for the domain and review the current and suggested values.

If you send from Microsoft 365, Google Workspace, Brevo or another external service, also set up the authentication that service provides. The cPanel DKIM key does not sign on its behalf.

If the DNS zone is on Cloudflare or another provider, publish the records there. Copy only the public DKIM key; the private one stays in the system that signs.

How to tell whether it works

Send a test through the real route and check the original headers, especially Authentication-Results, Return-Path and the DKIM signature. A DNS record existing does not prove it is being used when sending.

Continue with the deliverability guide to diagnose the whole picture, SPF to add senders and DMARC to define the policy.