Webmail request
en
Webmail request
nl en fr de
Setup & how-to

Setting up DKIM

You set up DKIM with a DNS record that attaches a digital signature to your outgoing email. Receiving servers check that signature and can see that your message really comes from your domain and hasn't been altered along the way. Think of it as an invisible wax seal on every envelope. Setting it up means adding one record in your DNS management, and you don't need any technical knowledge for it.

By the Mailflux team Published on

Reading and managing email in the webmail, on any device

What you need

  • A Mailflux mailbox on your own domain.
  • Access to the DNS management at your domain registrar or hosting provider.
  • The exact DKIM value for your domain, including the correct selector. It's ready in your Mailflux account. The key is unique per domain, so copy it literally and don't make anything up yourself.

Setting up DKIM: step by step

  1. Log in to your domain registrar and open the DNS management.
  2. In your Mailflux account, find the DKIM details for your domain: the selector, the name of the record and the long key value.
  3. Click Add record and choose TXT as the type (with some registrars this is called a CNAME; follow what Mailflux indicates).
  4. Under Name (or Host), enter the selector name, in the form selector._domainkey. The exact selector is in your account.
  5. Under Value, enter the full DKIM key. The form is v=DKIM1; k=rsa; p=[long key], but you copy the actual key from your Mailflux account.
  6. Save the record. Leave the key exactly as it is; a single missing character makes the signature invalid.

DKIM works best together with SPF and DMARC: together they show that your mail really comes from you. If you want to understand what happens under the hood, what is DKIM explains it calmly. The complete overview of all records is in email DNS records explained.

Why that long key has to be so precise

The key value in a DKIM record is long, sometimes a few hundred characters. That's normal: it's the public half of a key pair, and receiving servers use it to check the signature on your mail. Precisely because it's such a long string, it's easy to make copying mistakes. Copy the whole value in one go, without line breaks or extra spaces in between. If even one character is missing, the check fails and your mail is seen as unsigned.

Some registrars automatically split such a long value into chunks between quotation marks. That's fine, as long as you copy it the way Mailflux indicates. It only goes wrong if you add or leave out characters yourself.

Checking whether it worked

Once the change has been applied, you can use an online DKIM check on your selector to verify that the key has been published correctly. Then send a test email to an address at another provider and check in the message details whether DKIM shows as pass. If you see that, every email you send from now on gets a valid signature.

Not working?

  • The signature isn't recognised. The DNS change may not be active yet. Give it up to 24 hours and then test again.
  • The key is cut off. Some registrars truncate long values. Check that the full key has been saved, from v=DKIM1 to the last character.
  • The selector name is wrong. The name must match the selector in your Mailflux account exactly, including the ._domainkey part.
  • You accidentally added quotation marks. Some registrars do that automatically, others don't. Copy the value the way Mailflux indicates.

Done, and need help?

Once your DKIM record is active, every email you send gets a valid signature and you're seen as a trustworthy sender. If you're also going to use your mailbox in a program, you'll find the details at the IMAP server settings. Do you find working with DNS keys nerve-racking? We understand that completely. Let us know and we'll take a look with you or simply set DKIM up for you.

Ready to get started yourself?

Follow our step-by-step guide, or let us help you get set up personally.

Read the guide

Read more