Setting up DKIM

A DKIM record published in your domain name’s DNS lets us sign every message sent from an address on that domain.

That signature improves deliverability in a number of situations, because the recipient’s filters can check the message really left an authorised server and was not altered on the way. If you are not comfortable editing a DNS zone, do not change your domain’s records yourself: ask whoever manages them.

Procedure

Add a TXT record to your domain’s DNS zone for the DKIM signature.

Name of the new TXT record:

key1._domainkey

Value of the new TXT record:

k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBS1MQlwxbU/1G9t+NlS++HH2giISn3A2xg13hNHBxkOdAgJJIh4iSg5mY7W8+Fsl8ddPD5MxHNTg8ILTTx6U+ccoDq4+DAa4E+n8YnsFRoXJnt UO1fJrXVrvLRHPNb69jE9MG1OWfzQQlxTjdnJ/blY4D+p0uj+N4yKe+NXJzrwIDAQAB

Written out in full, the record reads:

key1._domainkey IN TXT "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBS1MQlwxbU/1G9t+NlS++HH2giISn3A2xg13hNHBxkOdAgJJIh4iSg5mY7W8+Fsl8ddPD5MxHNTg8ILTTx6U+ccoDq4+DAa4E+n8YnsFRoXJnt UO1fJrXVrvLRHPNb69jE9MG1OWfzQQlxTjdnJ/blY4D+p0uj+N4yKe+NXJzrwIDAQAB"

Two things worth checking before you save. The selector is key1, so the record name is key1._domainkey and nothing else; some control panels add your domain automatically, others expect you to type it in full. And the value must go in as a single string, without line breaks, even though it is long.

Then email technical support with your domain name so we can switch signing on. This step requires a manual operation on our servers, so it is not instant.

What it costs

Signing for one domain is included in the Team and Pro plans. Business plans allow up to five domains.

Setting up signing for an additional domain beyond those included is charged at €15 excl. tax.

Alongside DKIM

DKIM answers the question “was this message really signed by an authorised sender”. It works best next to SPF, which answers a different one: “was this server allowed to send for this domain”. Publish both. Most filters weigh them together, and our page on secure sending explains what we do on our side of the same problem.

If you are moving a device or an application over to us and it already sends through another provider, keep that provider in your SPF record until the migration is finished. Removing it early is the classic way to send your own mail to the spam folder.