SPF and DKIM help receiving mail servers trust email sent from your domain, so it's less likely to land in spam. Both are DNS records you add where your domain's DNS is managed, usually at your registrar. Your email provider gives you the exact values.
SPF: who may send email for your domain
An SPF record is a TXT record on @ that starts with v=spf1. It lists every service allowed to send email from your domain. Your domain must have only one SPF record. If you use several sending services, combine them into a single record with several include: entries separated by spaces:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
Common entries:
- Google Workspace:
include:_spf.google.com - Microsoft 365:
include:spf.protection.outlook.com - Mailchimp:
include:servers.mcsv.net - SendGrid:
include:sendgrid.net - A specific server:
ip4:followed by its IP address, for exampleip4:203.0.113.10
Keep the ending your email provider recommends (~all or -all) at the very end of the record.
DKIM: a signature on every email
DKIM adds a digital signature to the emails you send. The receiving server checks it against a public key published in your DNS, which proves the email really came from your domain and wasn't changed on the way.
To set it up, turn on DKIM in your email provider's admin settings. It gives you a record to add, usually a TXT record (sometimes a CNAME) with a name like google._domainkey. Add it at your registrar exactly as shown, then go back to your provider and start signing. Each sending service has its own DKIM record, and they can all exist side by side.
Emails from your WordPress site
If contact forms or a shop on your site send email from your domain, an SMTP plugin connected to your email provider or sending service sends them through that service, so they pass SPF and DKIM.
SPF and DKIM don't guarantee delivery, but they give receiving servers good reasons to trust your mail.