What This Guide Covers
| Record | What it does | Where you add it | Time to set up |
|---|---|---|---|
| DKIM | Proves the email was sent by you — not a forger | Namecheap Advanced DNS (TXT record) | 5 minutes |
| SPF | Tells receiving servers which IPs are allowed to send for your domain | Namecheap Advanced DNS (TXT record) | 2 minutes |
| DMARC | Tells receiving servers what to do if DKIM/SPF fail | Namecheap Advanced DNS (TXT record) | 2 minutes |
Verdict: DKIM is a single TXT record in your Namecheap DNS. Without it, up to 15% of your emails land in spam — even if your content is clean. Set up all three records (DKIM, SPF, DMARC) together in under 10 minutes for the best deliverability on Namecheap.
What DKIM Is in Plain English
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to every email you send. When a receiving server (Gmail, Outlook, etc.) gets your email, it checks the signature against a public key stored in your DNS. If the signature matches, the email is verified as genuinely from your domain.
Without DKIM, any server on the internet can send an email claiming to be from yourname@yourdomain.co.uk. DKIM makes this forgery detectable — and spam filters are trained to treat emails without DKIM as suspicious.
DKIM Setup for Namecheap Private Email
Namecheap Private Email generates your DKIM key automatically. You just need to enable it and add the generated TXT record to your DNS.
Step 1 — Enable DKIM in Namecheap Email dashboard
- Log in to Namecheap
- Go to Apps → Private Email
- Click Manage next to your email plan
- Click the Email Hosting tab
- Find DKIM and toggle it to Enabled
- Namecheap will show you a DKIM TXT record value — it looks like a long string of letters and numbers
- Copy the full record value
Step 2 — Add DKIM TXT record to Namecheap DNS
If your domain is registered with Namecheap and uses Namecheap BasicDNS (default):
- Go to Domain List → Manage for your domain
- Click the Advanced DNS tab
- Under Host Records, click Add New Record
- Set record type to TXT Record
- Set Host to:
default._domainkey - Set Value to: the DKIM key from Step 1 (the long string)
- Set TTL to Automatic
- Click the green checkmark to save
The host field must be exactly: default._domainkey — including the underscore and dot. Do not add your domain name to the host field; Namecheap DNS adds it automatically.
Step 3 — Verify DKIM is active
- Wait 10–30 minutes for DNS to propagate
- Go to mxtoolbox.com/dkim.aspx
- Enter your domain and selector
default - Click DKIM Lookup
- You should see: “This is a valid DKIM key record”
If MXToolbox shows “DKIM record not found”, wait another 30 minutes and try again. DNS changes can take up to 4 hours to propagate fully.
DKIM Setup for Google Workspace on Namecheap
Google Workspace requires you to generate the DKIM key in Google Admin Console and then add it to your Namecheap DNS. The DKIM selector for Google Workspace is google.
Step 1 — Generate DKIM key in Google Admin Console
- Log in to Google Admin Console at admin.google.com
- Go to Apps → Google Workspace → Gmail
- Click Authenticate email
- Select your domain from the dropdown
- Click Generate new record
- Leave the default settings (2048-bit key, selector: google)
- Click Generate
- Copy the TXT record value shown — it starts with
v=DKIM1; k=rsa; p=followed by the key
Step 2 — Add to Namecheap DNS
- In Namecheap, go to Domain List → Manage → Advanced DNS
- Add a new TXT record
- Set Host to:
google._domainkey - Set Value to: the full TXT record value from Google Admin Console
- Save with the green checkmark
Step 3 — Activate DKIM in Google Admin Console
- Return to Google Admin Console → Apps → Google Workspace → Gmail → Authenticate email
- Click Start authentication
- Google will verify the TXT record (may take 10–60 minutes)
- Status changes to “Authenticating email with DKIM” when active
SPF Record Setup on Namecheap
SPF (Sender Policy Framework) tells receiving servers which mail servers are authorised to send email for your domain.
For Namecheap Private Email
- In Namecheap Advanced DNS, add a TXT record:
| Field | Value |
|---|---|
| Type | TXT Record |
| Host | @ |
| Value | v=spf1 include:spf.privateemail.com ~all |
| TTL | Automatic |
For Google Workspace
| Field | Value |
|---|---|
| Type | TXT Record |
| Host | @ |
| Value | v=spf1 include:_spf.google.com ~all |
| TTL | Automatic |
Important: You can only have one SPF TXT record on the root (@) of your domain. If you send from multiple providers (e.g. Namecheap Private Email + Mailchimp), combine them into one record:
v=spf1 include:spf.privateemail.com include:servers.mcsv.net ~all
DMARC Record Setup on Namecheap
DMARC tells receiving servers what to do if DKIM or SPF checks fail. It also sends you reports about authentication failures.
Add DMARC TXT record in Namecheap Advanced DNS
| Field | Value |
|---|---|
| Type | TXT Record |
| Host | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:reports@yourdomain.com |
| TTL | Automatic |
DMARC policy options
| Policy | What it does | When to use |
|---|---|---|
| p=none | Monitor only — no action taken on failures | Start here — lets you see reports before enforcing |
| p=quarantine | Failing emails go to spam folder | After 2–4 weeks of clean reports with p=none |
| p=reject | Failing emails are completely rejected | When you are confident all legitimate email sources are in SPF/DKIM |
Start with p=none to gather reports. After 4 weeks, review reports at the rua email address — if all legitimate email is passing DKIM and SPF, upgrade to p=quarantine.
Testing Everything with MXToolbox
- Go to mxtoolbox.com/EmailHeaders.aspx
- Send a test email to yourself (or use mail-tester.com)
- View the raw email headers in your client (Gmail: three dots → Show original)
- Copy the headers and paste into MXToolbox Email Header Analyzer
- Look for: DKIM=pass, SPF=pass, DMARC=pass
All three showing PASS means your email authentication is correctly configured.
Frequently Asked Questions
How long does DKIM take to activate after adding the DNS record?
DKIM DNS records propagate in 10–60 minutes in most cases. The theoretical maximum is 48 hours but this is rare. You can check propagation progress at whatsmydns.net — search for a TXT record on default._domainkey.yourdomain.com.
Do I need DKIM if my emails are not going to spam?
Yes. DKIM protects against future problems, not just current ones. Without DKIM, any IP can send forged email claiming to be from your domain — damaging your reputation even if you never see the spam yourself. Also, email clients are tightening DMARC enforcement — by 2026, Google and Yahoo require SPF and DKIM for bulk senders, and are expanding these requirements.
Can I have both Namecheap Private Email DKIM and Google Workspace DKIM on the same domain?
No. You can only have one active email provider per domain. If you switch from Namecheap Private Email to Google Workspace, remove the default._domainkey TXT record and add the google._domainkey TXT record instead.
What is the DKIM selector for Namecheap Private Email?
The selector is default. The full DNS host is default._domainkey.yourdomain.com. For Google Workspace, the selector is google — full host: google._domainkey.yourdomain.com. The selector is the part before ._domainkey.
My DKIM is set up but emails are still going to spam. What next?
DKIM alone may not be enough. Check: (1) SPF record is present and correct — use MXToolbox SPF checker. (2) DMARC record is present. (3) Your sending IP is not on a blacklist — use MXToolbox Blacklist Check. (4) Email content itself may be triggering spam filters — use mail-tester.com to get a content score. See the full guide at Namecheap Email Deliverability 2026 for all 5 fixes.
