Talk to us

4. Deliverability

What is DKIM?

DKIM, short for DomainKeys Identified Mail, signs each outgoing message with a private key held by the sender. The matching public key sits in your DNS, so a receiver can confirm the message came from your domain and was not changed on the way.

The parts

  1. A signature travels with the messageThe sending system adds a DKIM-Signature header. It names the signing domain and the selector used to find the key.
  2. The selector finds the keySelectors let one domain hold several keys at once. The public key is published as a TXT record at selector._domainkey.yourdomain.
  3. The mailbox host issues the keyThe service that sends your mail generates the key pair and gives you the public half to publish. The private half never leaves the sender.
  4. It supports DMARCDMARC passes when SPF or DKIM passes and the domain in the visible From address lines up with the domain that was checked.

The DKIM record for cobaltway-mail.example

Cobaltway Analytics is invented. Its mailbox host issued a key under the selector google, and the company publishes it as a TXT record.

By hand

  1. The host gives Cobaltway a selector (google) and a public key value.
  2. Cobaltway publishes a TXT record at google._domainkey.cobaltway-mail.example.
  3. Each message sent from the domain now carries a signature that receivers check against that record.
  4. ColdMeetings lists the record in required_records once you pass dkim_value to POST /v1/domains, because the mailbox host issues the key.
FieldValueNote
TypeTXTDKIM keys are published as text records.
Namegoogle._domainkey.cobaltway-mail.exampleSelector, then _domainkey, then your domain.
Contentv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...Version, key type, then the public key.

DNS record to publish for DKIM. The key value is shortened here.

How to apply it

  1. Add the sending domain at your mailbox host and generate its DKIM key there.
  2. Publish the key as a TXT record at the selector name the host shows you.
  3. Pass the value to ColdMeetings, or publish it yourself, then run the domain check until dkim reports true.
  4. Rotate to a new selector when a key is replaced, and keep the old record until mail signed with it has aged out.

Mistakes to avoid

  • Publishing the record under the wrong selector name, so receivers never find the key.
  • Pasting a key with a line break or a missing character from a copy.
  • Enabling signing at the host before the DNS record is live.

SPF

SPF, short for Sender Policy Framework, is a DNS TXT record on your domain that lists the servers allowed to send mail using that domain.

Read more

DMARC

A DMARC policy is a DNS record you publish for your domain.

Read more

Sender reputation

Sender reputation is the running record a mailbox provider keeps about a sending domain or address, built from how recipients and receiving systems treated its past mail.

Read more

Questions

What does the selector do?
It is a label that tells a receiver which key to fetch, so a domain can use several keys at once, for example one per sending service or one per year.
Does DKIM encrypt my email?
No. DKIM signs a message so its origin and content can be checked. It does not hide the content.
Do I need both SPF and DKIM?
Google and Yahoo ask bulk senders to set up both. ColdMeetings treats a domain as authenticated only when SPF, DKIM and DMARC all check out.

Sources

Tell us what you sell and who buys it

What you sell

Who buys it

The button opens a draft in your own mail app. Nothing is sent from this page.

hello@coldmeetings.comEmail us
  • Software companies
  • Agencies
  • Service businesses