Spam lurks around every corner of cyberspace, and a staggering 91% of all cyberattacks begin with a phishing email to an unexpected victim. This research by Deloitte perfectly shows why it’s crucial to apply all possible safety measures to protect your domain from unwanted phishing attacks. And a DKIM record (DomainKeys Identified Mail) is among the most critical actions.
The number of DKIM keys tripled from 2020 to 2021. And with cyber threats evolving at an alarming pace, it's no wonder that the adoption of DKIM records has skyrocketed.
So, in this article, we gathered everything about DKIM, along with expert advice from email deliverability experts on setting up this record. Read on and empower yourself with the knowledge that will keep your digital doors bolted shut.
The Article Walkthrough:
What Is a DKIM Record?
Take a DKIM record like your passport: it helps you go through a face control and get into the recipient’s inbox. In simple words, it is a text record with your email signature used for the authentication of an email that’s being sent. It is essential to create both SPF records and DKIM as standards for email authentication that are used for DMARC alignment.
A DKIM record exists in the DNS, but it is a bit more complicated than SPF. DKIM’s advantage over SPF is that it can survive forwarding, which makes it superior to SPF and a foundation to save your email sender reputation.
❗ Folderly consulting experts recommend using both SPF and DKIM (and DMARC) to achieve 100% email deliverability and keep your domain safe. It’s not a choice between the two.
A DKIM record consists of a key pair.
- Public key. A public key is a TXT record added to your DNS record. Recipient servers can access it once you send a message and confirm that the sender’s address is valid and connected to the signature.
- Private key. This is a unique key. It’s added to your email signature. Your private key generates a DKIM signature for every email you send, ensuring that it won’t be copied or re-created by spoofers.
NB ❗ Although a receiving email server extracts your DKIM signature with a private key, nobody can see your unique private code.
Why Is DKIM Check Crucial for Email Deliverability
When the recipient server uses a DKIM signature to verify an incoming email and establish if it was actually sent from the domain indicated in the email address, this process is called the DKIM check.
- Helps to detect fake emails. By affirming the sender’s key, DKIM record helps to detect fake email addresses and fight against spam.
- Helps to establish solid email reputation. Since DKIM ensure spammers don’t use your personal domain name to send emails, it’s a must-to-implement step for a solid domain reputation. As a result—more chances to get into inbox.
- Gives access to Postmasters. Postmaster Tools are Google Account services for analytics. They help to track data on large volumes of emails sent and find data about your sending domain. To set up postmaster statistics, you need to have the correct email authentication such as DKIM and SPF.
How DKIM Works in Practice
STEP 1: If DKIM record is set up property, sender’s domain adds e-signature to the email using private key + publishes txt DNS record containing public key.
STEP 2: The receiving mail server extracts DKIM signature with private key from email header.
STEP 3: The receiving mail validates a sender using a public key from a DKIM DNS entry.
STEP 4: If public and private keys match, the message goes to the user's inbox. If they don’t match, an email goes to a spam folder.
How To Check Your DKIM Record
If you are a Microsoft 365 client, you can choose to do nothing about DKIM for your custom domain. Microsoft 365 automativally creates a private and public key pair, enables DKIM signing, and then configures the Microsoft 365 default policy for your custom domain.
❗However, if you answer “YES” to one of the following statements, it is important to manually configure your custom domain:
- You use more than one custom domain in Microsoft 365
- You're going to set up DMARC as well (you can do it with free DMARC Record Generator)
- You want have a 100% control over your private key
- You want to have customized CNAME records
- You want to set up DKIM keys for email originating out of a third-party domain, for example, if you use a third-party bulk mailer.
So, here’s a quick guide to check your DKIM setup:
- Send a message from your Microsoft 365 account with DKIM-enabled domain to another email account such as Outlook.com.
- Open the email and look at the header. The correctly DKIM-signed message will show the hostname and domain. The message will look like this:
❓ FAQ: Can a domain have multiple DKIM Records?
Yes, it can! A domain can have as many DKIM records for public keys as servers that send mail. Just make sure that they use different selector names.
How to generate DKIM in G-suite
If you DKIM test has failed or/and you want to create a customized DKIM record, follow the next steps in your G-Suite account.
Note! You can’t generate DKIM Record if you are just an end-user. You must be signed in as a super administrator (the one who has access to all features in the Admin console) to get the right to generate it.
1. Open your Google Admin console (at admin.google.com).
2. Go to Apps > G Suite > Gmail or follow the search request below.
a) Type DKIM and go to DKIM authentication.
b) On the Authenticate email page in the drop-down list, select a domain for DKIM authentication.
If you have multiple domains, make sure you select a domain you want to enable DKIM authentication. Otherwise, DKIM authentication may fail for your domain.
3. Click Generate New Record to generate DKIM record.
If you have just created your G Suite account and turned on Gmail, you have to wait 24–72 hours before you can generate a DKIM key.
4. Select DKIM 2048-bit key (The “2048-bit” is the length of the key, which determines its strength. The longer key means enhanced security) and click Generate.
5. After the generation is complete, go to the domain registrar (where you manage DNS records) and add the TXT type record with the following Host name and record value:
When the record in the domain registrar is saved go back to the Google Admin and click the Start Authentication button.
Important! In most cases, the email authentication process takes up to 48 hours to verify. If you encounter a message like this, make sure you entered the correct DKIM TXT record into the domain provider's settings and come back later. Then, you can again click the Start Authentication button to enable DKIM.
Conclusion: Navigating the Intricacies of DKIM
Implementing DKIM not only safeguards your brand's reputation but also enhances email deliverability. It’s a vital layer of protection against phishing attempts, email spoofing, and other fraudulent activities, bolstering your overall email security.
However, it's crucial to remember that DKIM implementation is not a one-size-fits-all approach. Each organization may have specific requirements and nuances that require expert guidance.
If you need assistance or further insight into email deliverability best practices, fear not. Our team of email deliverability experts at Folderly is here to provide you with comprehensive consulting services tailored to your unique needs. We have the knowledge and expertise to help you navigate the intricacies of DKIM and other email authentication methods, ensuring your emails reach their intended destinations.
Also, should you have any questions or concerns regarding DKIM or any other email-related matters, please don't hesitate to contact us at support@folderly.com. We are dedicated to assisting you in your journey towards optimized email deliverability and unrivaled sender reputation.
