Free tools Windows power users keep installed
One-click scans. No signup required.
For Node.js mail, SPF and DKIM do different jobs, and you generally need both. SPF authorizes sending hosts in DNS; DKIM adds a signature to each message that the recipient can verify. DKIM is often the more durable signal when your app uses multiple providers, shared infrastructure, or changing IP addresses, but it cannot guarantee inbox placement. Keep SPF accurate and add DMARC so receivers can apply policy and check alignment.
What SPF and DKIM actually check
| Question | SPF | DKIM |
|---|---|---|
| What is checked? | Whether the host connecting to send the message is authorized by the domain’s DNS policy. | Whether a cryptographic signature for selected message headers and the body can be verified. |
| Where is the DNS record? | In the sending domain’s SPF TXT record. | At <selector>._domainkey.<domain>, where the receiver looks up the public key. |
| What does it help establish? | That a particular sending host is authorized for the domain. | That the signed parts of the message have a verifiable signature associated with the signing domain. |
| Typical failure in Node.js delivery | A provider or sender is missing from the SPF policy, or forwarding changes the apparent sending host. | The selector or public key is published incorrectly, the private and public keys do not match, or infrastructure changes signed headers. |
| Node.js action | Maintain one accurate SPF policy that covers every legitimate sender. | Configure Nodemailer’s domainName, keySelector, and privateKey, then publish the matching public key. |
SPF does not sign the message or protect its contents. DKIM does not authorize every server that may send for your domain. They are complementary checks, not interchangeable alternatives.
As an Amazon Associate I earn from qualifying purchases.
Is DKIM better than SPF when Node.js mail goes to spam?
DKIM is often the better first fix when your application sends through several providers, shared mail infrastructure, or systems with changing IP addresses. Its signature accompanies the message, whereas SPF evaluates the host seen by the receiving server. Forwarding can therefore complicate SPF results, and an SPF policy that omits a legitimate provider can fail for mail sent through that provider.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThat does not make SPF optional. Keep a single accurate SPF policy and include every service that legitimately sends mail for the domain. Google warns that messages from third-party senders missing from SPF are more likely to be marked as spam. DKIM signing also depends on correct DNS publication and on downstream systems not changing signed headers.
#1 Best Overall
Neither SPF nor DKIM passing guarantees that a message will reach the inbox. Google says authenticated messages help protect recipients from spoofing and phishing, and that authentication makes mail less likely to be rejected or marked as spam. Content, list hygiene, reverse DNS, TLS, and sender reputation also matter.
Gmail’s sender requirements
These requirements are specific to Gmail and may change. Google’s sender guidance says all senders need SPF or DKIM. Senders that send more than 5,000 messages per day to Gmail have additional requirements: SPF, DKIM, and DMARC. Google’s bulk-sender requirements took effect February 1, 2024.
Rank #2
- For bulk senders, configure SPF and DKIM so they are aligned with each other at the organizational level, and use DMARC.
- For personal Gmail delivery, Google’s current guidance sets a 1,024-bit minimum DKIM key and recommends a 2,048-bit key when supported.
- Google’s 2024 bulk-sender guidance cites a 0.30% user-reported spam-rate ceiling. Monitor your complaint and spam rates rather than treating authentication as a substitute for good list practices.
DMARC gives receiving systems a policy and checks whether SPF or DKIM authenticates in alignment with the domain visible in the message’s From: address. Passing a check for a different domain is not the same as alignment.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How to add DKIM signing in Nodemailer
Nodemailer supports DKIM signing for a whole transport or an individual message. For transport-wide signing, provide your signing domain, selector, and private key when creating the transporter:
Rank #3
const transporter = nodemailer.createTransport({
host: "smtp.example.com",
port: 465,
secure: true,
dkim: {
domainName: "example.com",
keySelector: "2017",
privateKey: fs.readFileSync("./dkim-private.pem", "utf8"),
},
});With these example values, publish the corresponding public key as a TXT record at 2017._domainkey.example.com. The selector in Nodemailer must match the selector in that DNS name, and the published public key must match the private key used to sign. Keep the private key available to the sending application but do not publish it.
Nodemailer recommends checking the DNS record with dig TXT 2017._domainkey.example.com. DNS providers may display or return TXT data in chunks; verify the full value rather than assuming one displayed string is the entire record.
Rank #4
If an SMTP provider rewrites Date or Message-ID after Nodemailer signs the message, DKIM verification can fail. Nodemailer’s DKIM options include skipFields for excluding mutable headers from signing; use it only for headers your delivery path actually changes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhy SPF can pass while Gmail still marks mail as spam
An SPF pass means the connecting host passed the domain’s SPF policy; it does not establish that the message is desirable, that DKIM passes, or that DMARC alignment succeeds. Inbox placement is a broader decision than a single authentication result. A message can pass SPF and still be filtered because of other authentication results, sender reputation, content, or recipient complaints.
Check the receiving message’s Authentication-Results header to see the separate SPF, DKIM, and DMARC outcomes. Interpret each result in context: identify which domain each mechanism authenticated and whether it aligns with the visible From: domain.
Troubleshoot Node.js mail in this order
- Inspect the received message. Open its full headers and find
Authentication-Results. Record the SPF, DKIM, and DMARC results and the domains involved. - Check SPF policy coverage. Confirm there is exactly one SPF TXT policy for the sending domain and that it includes every legitimate Node.js sender and provider. A missing third-party sender can make its messages more likely to land in spam.
- Verify DKIM DNS and key selection. Query the selector TXT record, confirm the name matches the Nodemailer
keySelector, and ensure the public key corresponds to the private key configured in the application. - Check for post-signing changes. Find out whether an SMTP relay or other downstream system rewrites signed headers such as
DateorMessage-ID. Exclude headers with Nodemailer’sskipFieldsoption if they are in fact being changed. - Review DMARC and alignment. Confirm the authenticated SPF or DKIM domain aligns with the visible
From:domain and that your DMARC policy reflects the intended handling. - Investigate non-authentication causes. Review message content, list hygiene, reverse DNS, TLS, and sender reputation; SPF and DKIM passes alone do not guarantee inbox placement.
When diagnosing DNS in Node.js, dns.resolveTxt() returns a two-dimensional array because a single TXT record can be split into multiple chunks. Join or otherwise interpret the chunks belonging to each record before evaluating its policy; treating each chunk as a separate record can lead to a mistaken diagnosis.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
