SPF says which servers may send for your domain; DKIM (DomainKeys Identified Mail) goes further and cryptographically signs each message so the receiver can verify it came from your domain and was not modified in transit. Inbox providers in 2026 expect both — and DKIM survives forwarding, which SPF does not.

How DKIM Works

Your mail server holds a private key and signs selected headers and the body of every outgoing message. The matching public key is published in your DNS as a TXT record at a name like selector._domainkey.yourdomain.com.np. The receiving server fetches that key, checks the signature, and records a pass or fail that feeds spam scoring and DMARC.

Enabling DKIM on Common Platforms

  1. cPanel: open Email Deliverability, and if DKIM shows a problem, click Repair — cPanel generates the key and installs the record automatically when DNS is hosted on the same server.
  2. Zoho Mail: in the Admin Console open Domains → your domain → Email Configuration → DKIM, generate a selector, and paste the given TXT record into your DNS zone, then click Verify.
  3. Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate email; generate the key (2048-bit), publish the TXT record, then click Start Authentication.
  4. Newsletter and transactional tools: each sending service needs its own DKIM records — check their domain authentication pages.

Verifying It Works

  • Send a message to a Gmail address, open it, choose Show original, and look for DKIM: PASS with your domain.
  • Use a mail-tester style scoring service and aim for a clean authentication section.
  • Check the record itself with a DKIM lookup tool using your selector name.

Common DKIM Problems

  • Record too long for the DNS panel: 2048-bit keys sometimes need splitting into two quoted strings — most panels handle this automatically, some do not.
  • Signature fails after mail is modified: disclaimers or footers added by a relay after signing break the signature — sign after all modifications.
  • Wrong selector: the DNS name must exactly match the selector your platform announced.
  • Multiple platforms, one domain: perfectly fine — each service uses its own selector, and many DKIM records can coexist.

Does DKIM Really Move the Needle?

Yes. Aligned DKIM is now effectively mandatory for reliable Gmail delivery, and it is the signal that keeps forwarded messages authenticated. For Nepali businesses emailing international clients, tenders and INGO partners, a passing DKIM signature is the difference between the inbox and the junk folder more often than the content of the message itself.

Frequently Asked Questions

Do I need DKIM if I already have SPF?

Yes. They cover different failure cases, and DMARC — which Gmail rewards — needs at least one of them aligned; having both is the resilient setup.

How often should keys rotate?

Best practice is roughly yearly, or immediately after any suspected compromise. Managed platforms like Zoho and Google handle rotation for you.

All WebsNP mail servers ship with DKIM enabled — see business email, Zoho Mail setup, or request a records audit.