If your sales proposals or customer order updates are disappearing into spam filters, your email authentication records are likely incomplete. Here is the definitive, plain-English engineering guide to configuring SPF, DKIM, and DMARC records correctly.
| Type | Host | Target / Value | State |
|---|---|---|---|
| MX | @ | 10 mx1.wigosend.com | Valid (100%) |
| TXT | @ | v=spf1 include:_spf.wigosend.com ~all | Valid (100%) |
| TXT | wg1._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9... | 2048-bit Signed |
| TXT | _dmarc | v=DMARC1; p=quarantine; pct=100 | Enforced |
Why email deliverability got strict#
The SMTP protocol was designed in 1982 with zero built-in identity verification. Anyone could connect to an open mail server and claim to be `ceo@yourcompany.com`. Spammers and phishing networks abused this for decades.
Today, major mailbox providers—including Gmail, Microsoft Outlook, Apple Mail, and Yahoo—require strict domain authentication. Unauthenticated emails are rejected at the edge or funneled directly into the spam folder.
DKIM: The cryptographic tamper seal#
DomainKeys Identified Mail (DKIM) adds an asymmetric digital signature to every outgoing message header. The sending server holds the private key; the public key is published in your domain's DNS under a specific selector (e.g. `wg1._domainkey.yourdomain.com`).
When the receiving server accepts your email, it calculates a hash of the body and headers and verifies it against the published public key. If an intermediary tampered with the content or spoofed the sender, the signature breaks.
; 2048-bit DKIM Public Key Record
wg1._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3..."DMARC: The enforcement policy#
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It instructs receiving mail servers what to do if an incoming message claims to come from your domain but fails SPF or DKIM alignment.
A standard rollout starts with `p=none` (monitoring only) to collect telemetry reports, followed by `p=quarantine` (deliver to spam folder), and finally `p=reject` (reject fraudulent mail completely).
Syntax cheatsheet and examples#
Here is the recommended production DMARC record to protect your brand identity while collecting daily diagnostic reports:
Automated verification in WigoSend
When you add a domain in the WigoSend console, our DNS checker automatically pings your nameservers every 120 seconds to confirm SPF, DKIM, and DMARC validity.
; Production DMARC enforcement policy
_dmarc 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@wigosend.com; pct=100; sp=quarantine"Testing and automated validation#
Before sending bulk business communications, always send a test message to a deliverability checker. In the WigoSend dashboard, the Domain Health card provides one-click verification of all cryptographic records. Need configuration walkthroughs? Browse our DNS Setup Guides in the Help Center, set up domain authentication for WigoSend Mail, or follow our Migration Readiness Checklist before cutting over.
Published by David Ochieng
Infrastructure & Deliverability Lead at WigoSend. Specializing in high-reliability email routing, data sovereignty, and communication infrastructure.
Engineering & protocol notes delivered to your inbox.
No marketing spam. Only technical deep-dives on email protocols, DNS, and platform updates once or twice a month.