With GMass\u2019s DKIM settings<\/strong>, you can make sure your emails are DMARC compliant<\/strong>\u00a0(in most cases) when you\u2019re sending through an external SMTP server<\/strong>.<\/p>\n In this guide, I\u2019m going to cover the DKIM settings inside the GMass dashboard<\/strong>\u00a0and walk you through how (and why) to use them<\/strong>\u00a0to hit DMARC alignment.<\/p>\n Note to email pros: If you want to skip through the What Is DKIM? section to jump to the setup instructions for GMass<\/a>, go for it. However, I am covering some nuance in the What Is DKIM? section, including some things you might not know about which different SMTP services strip out custom DKIM headers, so you might want to give it a quick glance on your way down. <\/em><\/p>\n DKIM, which stands for DomainKeys Identified Mail, is one of the three primary email authentication methods that email systems can use to weed out fraudulent and spoofed emails.<\/p>\n With DKIM<\/strong>, an email client can confirm that an email that claims to come from a specific domain was actually sent by that domain<\/strong>.<\/p>\n DKIM works by attaching a domain name\u2019s verifiable digital signature to an email. The email system that receives that email can verify the signature against the domain name\u2019s records to confirm its validity.<\/p>\n All that happens behind the scenes \u2014 so if you\u2019re failing DKIM, you wouldn\u2019t know without doing some investigation. (We\u2019ll get more into that later in this article and cover how to use an email analyzer tool to check your DKIM settings.)<\/p>\n DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance, is another email authentication method.<\/p>\n DMARC uses DKIM (and\/or SPF) to authenticate emails<\/strong>\u00a0and also gives a server instructions<\/strong>\u00a0on what to do if an email from your domain fails both DKIM and SPF checks, or both DKIM and SPF alignment<\/strong>.<\/p>\n When DKIM (or SPF) is aligned, it lets a receiving mail server know an email is<\/em>\u00a0from the domain it says it’s from.<\/p>\n That can make a difference in deliverability<\/strong>\u00a0(along with making it harder for people sending spam and phishing emails to spoof your domain).<\/p>\n DMARC does not require alignment on both DKIM and SPF (Sender Policy Framework) \u2014 just one.<\/p>\n And it\u2019s trickier for DMARC to get SPF alignment than DKIM alignment<\/strong>.<\/p>\n Why? It\u2019s largely because SPF uses the Mail From (aka the Return-Path) domain for authentication, while DKIM uses the domain from the sender\u2019s email address.<\/p>\n In order to achieve SPF alignment, the Mail From domain has to match the sending domain \u2014 which often isn\u2019t the case when you\u2019re using a third-party SMTP server.<\/p>\n The SMTP service would need to support a custom Mail From domain for every sender<\/strong>, which isn\u2019t always the case \u2014 and adds a whole new layer of complexity to the setup process if it is<\/em>\u00a0the case.<\/p>\n Also, \u00a0the Mail From domain requires two DNS records (MX for receiving and processing bounces and TXT for SPF authentication) while DKIM requires just a TXT record<\/strong>.<\/p>\n And with a third-party SMTP server, getting the MX record to work with that server is cumbersome and complicated<\/strong>\u00a0\u2014 you\u2019d need to set up a new subdomain to use as the Mail From, or else all emails sent to your main domain would go to the third-party server instead of your email account.<\/p>\n Plus, the subdomain means that the SPF alignment will be considered relaxed<\/em>\u00a0and not strict<\/em>. With DKIM, there\u2019s no messing around with a subdomain so the alignment will be <\/strong>strict<\/strong><\/em>, which is preferred.<\/p>\n Overall, DKIM is both more reliable and less complicated to set up than SPF \u2014 which is why it\u2019s a better choice for DMARC alignment.<\/p>\n By default, GMass sends your email campaigns through Gmail\u2019s servers. Those are reliable, high-deliverability servers \u2014 arguably the highest-deliverability servers in the world.<\/p>\n However, GMass also enables you to use a SMTP server to send campaigns. That gives you the ability to break Gmail\u2019s daily sending limits (up to 500 emails for a free gmail.com account and up to 2,000 emails for a Google Workspace account).<\/p>\n If you\u2019re using a SMTP server \u2014 either your own third-party server or one of GMass\u2019s in-house SMTP accounts \u2014 you can set DKIM in the GMass dashboard<\/strong>.<\/p>\n From there, one of two things will happen when you send your campaign.<\/p>\n You can wind up with multiple DKIM signatures: One set by GMass and one by your SMTP server. That\u2019s ok \u2014 your emails can have multiple DKIM signatures and still pass DMARC. It\u2019s all good.<\/strong><\/p>\n This scenario can happen if you\u2019re using your own third-party SMTP service or one of GMass\u2019s in-house offerings.<\/p>\n Some SMTP servers strip away custom DKIM headers. (See the list next.) In those cases, if you\u2019re using your own SMTP service, you\u2019ll need to set up DKIM with your SMTP provider<\/strong>.<\/p>\n In the next section of this article we\u2019ll cover DKIM and DMARC setup steps.<\/p>\n A note to free gmail.com email users:\u00a0<\/strong>Due to a Google policy change in early 2024, we’ve built a special system for you. Follow the instructions here<\/a> and learn about how GMass helps gmail.com users achieve DMARC compliance.<\/p>\n Here are the results of our testing on which popular SMTP services strip away custom DKIM headers and which don\u2019t.<\/p>\n Here are the popular services that do and don\u2019t strip custom DKIM headers:<\/p>\n Now it\u2019s time to set everything up the right way in GMass (and\/or your third-party SMTP service).<\/p>\n Here\u2019s what you need to do to set up DKIM to pass DMARC when you use a SMTP server with GMass.<\/p>\n In case you didn\u2019t know, GMass has accounts with some SMTP services, as well as an in-house homegrown SMTP server, which some GMass users can access.<\/p>\n You can apply to use<\/a> GMass\u2019s SMTP services if you send opt-in emails and you have a reliable sending history and reputations. You’ll get an instant verdict<\/a> on whether or not you’re approved.<\/p>\n Before\u2026 if you used GMass with one of our in-house SMTP accounts, it was impossible for your emails to be DMARC compliant.<\/p>\n They would pass SPF and DKIM\u2026 but they would fail DMARC alignment (if you had a DMARC record published, of course). While that didn’t affect deliverability for most users, it could<\/em>\u2026 plus it could lead to Google\u2019s spoofing warning.<\/p>\n But with our new DKIM abilities, that\u2019s no longer the case<\/strong>.<\/p>\n With GMass\u2019s DKIM settings now, you can make sure your emails are DMARC compliant or DMARC ready<\/strong>\u00a0in most cases when using an external SMTP server.<\/p>\n If you\u2019re on GMass\u2019s own SMTPGM server, it will preserve your custom DKIM settings and, assuming all is set up correctly in your DNS records, you\u2019ll pass DMARC<\/strong>.<\/p>\n But regardless, we always recommend setting up DKIM in the GMass dashboard if you\u2019re going to use SMTP for sending. (That way, if your SMTP service changes in the future, you\u2019ll hit DMARC alignment.)<\/p>\n If you\u2019re using your own third-party SMTP server account, there are other options.<\/p>\n If your service is one that preserves the DKIM headers<\/strong>\u00a0that GMass passes along (services like Amazon SES and ReachMail), you should set up DKIM in the GMass settings<\/strong>.<\/p>\n If your service strips out DKIM headers<\/strong>\u00a0(SendGrid, for example), you\u2019ll need to set up DKIM at your SMTP provider<\/strong>.<\/p>\n However, we still<\/em>\u00a0recommend setting up DKIM in GMass in case you use a different provider in the future or your service decides to stop stripping our DKIM headers.<\/p>\n I\u2019m creating these instructions under the assumption that you have an SMTP service set up in GMass, either one of GMass\u2019s internal servers or your own third-party server.<\/p>\n (If you haven\u2019t set one up yet, you can do so in the GMass dashboard, in the SMTP Server<\/strong>\u00a0section.)<\/p>\n Now let\u2019s set up DKIM.<\/p>\n Go to the GMass dashboard<\/a>\u00a0for your account.<\/p>\n Click the gear icon in the top right for Settings<\/strong>. Then click Email Authentication<\/strong>\u00a0on the left fly-out menu and choose Manage DKIM Settings<\/strong>.<\/p>\n Click the Create a new DKIM entry<\/strong>.<\/p>\n Type in\u2026<\/p>\n Then click the Create this key<\/strong>\u00a0button.<\/p>\n Now click Key Details<\/strong>.<\/p>\n You\u2019ll need to grab DNS Record<\/strong> (in my case, Go to your domain registrar and go into the DNS settings for your domain. (Where you\u2019ll find those settings varies at every domain registrar, but generally they\u2019re easy enough to track down.)<\/p>\n Create a new DNS record<\/strong>, and for the type of record, you want TXT<\/strong>.<\/p>\n The host name should be Save the settings<\/strong>\u00a0at your registrar.<\/p>\n Go back to the DKIM settings in the GMass dashboard and click the link to Active this key<\/strong>. You may need to give this some amount of time for the DNS record to propagate.<\/p>\n Once your new DNS record has propagated and you hit the Active<\/strong>\u00a0link, GMass will give you a success message.<\/p>\n If you\u2019re using your own third-party SMTP server and it\u2019s one (like SendGrid) that strips out DKIM headers, this is when you\u2019d go to your SMTP provider and set up your DKIM record there<\/strong>.<\/p>\n If your own third-party SMTP server retains the DKIM headers it receives from GMass (like Amazon SES), you don\u2019t need to also set up DKIM there.<\/p>\n Now you can create a DMARC record for your domain. I used this DMARC Record Wizard<\/a>\u00a0to create mine, though you can probably just adapt yours from what I did.<\/p>\n I went with Strict<\/strong>\u00a0authentication for DKIM.<\/p>\n Now go back to your domain registrar, create another new TXT record<\/strong>, and enter your DMARC settings.<\/p>\n Once again, it may take a bit of time for the record to propagate.<\/p>\n Once you\u2019ve set everything up \u2014 and given it some time for all your records to propagate (this is definitely my personal record for uses of the word \u201cpropagate\u201d in one article) \u2014 it\u2019s time to run a test<\/strong>.<\/p>\n Head to GMass\u2019s free Email Analyzer<\/a>\u00a0tool, which shows you all the underlying technical info about your email.<\/p>\n Copy the testing email address<\/strong>\u00a0you see on the screen.<\/p>\n Then go to Gmail. Compose a new email<\/strong>\u00a0and paste in the testing email address in the To field.<\/p>\n Open the GMass settings box and under Action<\/strong>, make sure your SMTP server is selected.<\/p>\n You can type in anything as the subject and body (I put \u201ctest\u201d in both), or leave them blank.<\/p>\n Then hit the GMass button<\/strong>\u00a0and NOT the blue Gmail Send button <\/strong>to send your message through your SMTP server.<\/p>\n Go back to the Email Analyzer. Once it receives the message, it will show you all the behind-the-scenes technical info about your email.<\/p>\n You can see the DKIM headers<\/strong>\u00a0from your SMTP service and, assuming your SMTP service retains the DKIM header you just created, that one as well. Since I sent my email using GMass\u2019s in-house SMTP server, which retains DKIM, I see both headers.<\/p>\n (And again, as I mentioned before, multiple DKIM headers for an email are not a problem.)<\/p>\n And when one of the DKIM headers is aligned, you\u2019ll see a successful result in the DMARC section<\/strong>\u00a0of the report.<\/p>\nDKIM Settings in GMass: Table of Contents<\/h2>\n
\n
What Is DKIM?<\/h2>\n
How DKIM relates to DMARC<\/h3>\n
Why it\u2019s easier to pass DMARC alignment with DKIM vs. SPF<\/h3>\n
How DKIM Works When You Send Messages Through GMass Using an SMTP Server<\/h3>\n
![\"\"](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/dkim-gmassdash-2-tinified.png\")
<\/a><\/p>\nScenario 1<\/h4>\n
Scenario 2<\/h4>\n
Which SMTP services strip out custom DKIM headers and which don\u2019t<\/h3>\n
\n
Setting DKIM and Passing DMARC When You Use a SMTP Server With GMass<\/h2>\n
First: Are you using one of GMass\u2019s SMTP servers or your own third-party server?<\/h3>\n
If you\u2019re using GMass\u2019s SMTP servers<\/h4>\n
If you\u2019re bringing your own server<\/h4>\n
Setting up DKIM and DMARC with GMass<\/h3>\n
Create your DKIM entry in GMass<\/h4>\n
![\"\"](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/dkim-managesettings-2-tinified.png\")
<\/a><\/p>\n\n
![\"Create](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image2.png\")
<\/a><\/figure>\n![\"Get](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image7.png\")
<\/a><\/figure>\nmynew1._domainkey.pollentagency.com<\/code>) and the DNS Record Value<\/strong> (a long string that starts with v=DKIM1<\/code>).<\/p>\nCreating the DNS record for your key<\/h4>\n
selector._domainkey.yourdomain.yourdomainsuffix<\/code>. Then for the data\/value section, paste in the long text string GMass generated; it should start with v=DKIM1<\/code>.<\/p>\n![\"Add](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image9.png\")
<\/a>Authenticate the record in GMass<\/h4>\n
![\"Success](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image1.png\")
<\/a><\/figure>\nCreate your DMARC record<\/h4>\n
![\"Adding](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image6.png\")
<\/a>Testing your DKIM headers and whether you\u2019re passing DMARC<\/h4>\n
![\"Send](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image5.png\")
<\/a><\/figure>\n![\"Find](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image11.png\")
<\/a><\/figure>\n![\"DMARC](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2023\/08\/image8.png\")
<\/a><\/figure>\nDKIM Settings in GMass: Next Steps<\/h2>\n