Set up DKIM for a sending service

Before you start

DKIM lets a mailbox provider check that mail signed with example.com really came from a service you allow. The service signs each message, and a key you publish in DNS proves the signature.

DMARC counts a DKIM pass only when the signing domain, the d= value in the signature, is example.com or a subdomain of it. If your DMARC record has adkim=s, it must be exactly example.com.

Turn on DKIM in the service

1. In the sending service, find the setting for domain authentication or DKIM. The service's own guide shows where it is.
2. Add example.com there. The service then gives you one to three DNS records, usually CNAME records whose names end in ._domainkey.example.com.
3. Publish each record in your domain's DNS exactly as the service shows it. If your DNS host adds example.com to every name, enter only the part before it.
4. Go back to the sending service and press its verify button.

Sign with your own domain

Today the sending service signs your mail with its own domain. DKIM passes but does not align with example.com, so DMARC does not count it.

1. In the sending service, turn on custom DKIM. Some services call it a branded sending domain or an authenticated domain.
2. Publish the records it gives you, as in Turn on DKIM in the service.

When the service cannot sign for example.com

the sending service cannot sign mail with example.com. Without a DKIM signature from example.com, this mail passes DMARC only if SPF aligns with example.com, and a service that sends under its own domains rarely does.

Pick one:

1. Send this mail from an address that belongs to the sending service, and put your own address in Reply-To. The mail then is not sent as example.com, and replies still reach you.
2. Move the mail to a service that can sign with example.com, and set it up as in Turn on DKIM in the service.
3. Stop sending it, if nobody needs it.

Until then, do not move to a stricter policy: this mail would be refused.

Use your own bounce domain too

SPF checks the envelope sender, the hidden address that bounces go back to. SPF aligns for DMARC only when the envelope sender's domain is example.com or a subdomain of it.

Many services call this setting a custom return path or a bounce domain. It is usually one CNAME record, such as bounce.example.com, that points to the service. Publish it next to the DKIM records and verify both in the sending service.

With both DKIM and SPF aligned, mail from the sending service still passes DMARC if one of the two breaks.

Set up the service

Mail from the sending service uses example.com but has neither DKIM nor aligned SPF, so it fails DMARC.

If your organization uses the sending service, set it up with the three sections above. If nobody at your organization uses the sending service, treat it as someone else sending as you. The guide on finding out who an unknown source is shows how to check.

Check it worked

Most mailbox providers send one report a day, so reports from the next 24 to 48 hours show whether DKIM aligns for the sending service. The DKIM table on Mailmoni's DNS tab lists the new selector once a report includes it.