- \n
- Generating your DKIM key<\/li>\n
- Setting up DKIM for your domain<\/li>\n
- Testing to make sure everything worked<\/li>\n<\/ul>\n
And we should be able to do this in less than five minutes<\/strong>\u00a0(assuming you know all your account passwords, which is the part that always slows me down).<\/p>\n
Do note: This guide is written for GMass users who are sending through a Google Workspace account. If you\u2019re a GMass user sending through an external SMTP server (usually to break Gmail\u2019s limits), there are special settings for you which we\u2019ll cover here as well.<\/p>\n
How to Set Up DKIM: Table of Contents<\/h2>\n
- \n
- What Is DKIM in Under 100 Words?<\/a><\/li>\n
- Step 1: Getting Your DKIM Key<\/a><\/li>\n
- Step 2: Adding Your DKIM Record to Your Domain<\/a><\/li>\n
- Step 3: Authenticating and Verifying Your DKIM Record<\/a><\/li>\n
- If You\u2019re Using a Third-Party SMTP Service with GMass<\/a><\/li>\n
- How to Set Up DKIM: Next Steps<\/a><\/li>\n<\/ul>\n
What Is DKIM in Under 100 Words?<\/h2>\n
DomainKeys Identified Mail (DKIM) is a digital signature attached to your emails which allows a mail server to determine if that email was authorized for your domain.<\/p>\n
For example, if a spammer spoofs your domain and sends messages from an unauthorized server, they would fail DKIM authentication<\/strong>. A recipient\u2019s mail server could\/should then send the message to spam or not deliver it at all.<\/p>\n
That\u2019s why having DKIM set up for your domain\u00a0can be good for your deliverability \u2014 it helps prove you are who you say you are<\/strong>.<\/p>\n
How do SPF and DMARC relate to DKIM?<\/h3>\n
DKIM is one of the three primary email authentication methods. The others are:<\/p>\n
- \n
- Sender Policy Framework (SPF)<\/li>\n
- Domain-based Message Authentication, Reporting, and Conformance (DMARC)<\/li>\n<\/ul>\n
SPF<\/strong>, like DKIM, is a domain record<\/strong>\u00a0which mail servers use to determine whether a sender using your domain was authorized to do so.<\/p>\n
DMARC is a different type of record. It\u2019s a policy you create that works with SPF and\/or DKIM<\/strong>. The DMARC record shares whether your emails are using SPF and\/or DKIM as authentication methods, and lets a mail server know what to do with messages that fail those methods<\/strong>.<\/p>\n
Do I need to set up DKIM?<\/h3>\n
As of February 1st, 2024, Google and Yahoo\/AOL\u2019s new sender policies require anyone who sends using their own domain name<\/strong>\u00a0(e.g., whatever@yourdomain.com) to have either a SPF or DKIM record in place.<\/p>\n
So you do<\/em>\u00a0need to set up DKIM or SPF.<\/p>\n
If you\u2019re a bulk sender<\/a>\u00a0\u2014 defined as sending 5,000+ emails per day to gmail.com addresses or a \u201csignificant volume\u201d to Yahoo\/AOL addresses \u2014 you need to have both SPF and DKIM records. You\u2019ll also need DMARC in place.<\/p>\n
I heard Google will use a default DKIM key if I don’t have one set up… so do I still need to do any of this?<\/h3>\n
You heard right. If you’re using Google Workspace, Google will automatically sign your message with its default DKIM key,
d=*gappssmtp.com<\/code>.<\/p>\nThe good news: If you don’t go through the steps in this article, you’ll still pass DKIM.<\/p>\n
But… if you want to use DMARC authentication to boost your deliverability, then we recommend you still go through the process of setting up your own DKIM key. That way you can hit DKIM alignment.<\/p>\n
And as I’ll keep saying through this article, if you’re going to use a third-party SMTP service to send messages through Gmail with GMass, follow these instructions to set up DKIM the right way<\/a> for that scenario.<\/p>\n
Will having a DKIM record help deliverability?<\/h3>\n
Having DKIM in place can help with deliverability<\/strong>\u00a0\u2014 that is, it helps your emails reach the inbox, not the spam folder.<\/p>\n
Google says so<\/a>, point blank: \u201cWithout DKIM, messages sent from your organization or domain are more likely to be marked as spam by receiving mail servers.\u201d<\/p>\n
DKIM alone does not, however, guarantee every email you send will reach the inbox<\/strong>.<\/p>\n
There are lots<\/em>\u00a0of factors that go into deliverability, ranging from your sender reputation to the contents of your email to whether recipients in the past have engaged with your messages. That being said, having DKIM and the other authentication methods set up is absolutely a piece of the deliverability puzzle.<\/p>\n
Do I need to set up DKIM if I have a gmail.com email address?<\/h3>\n
You cannot set up DKIM if you have a gmail.com address \u2014 because you can\u2019t.<\/p>\n
Setting up DKIM (or SPF, or DMARC) requires you to create a DNS record for your domain. (Again, don\u2019t worry, I\u2019ll show you how to do that later in this article.)<\/p>\n
You can\u2019t create DNS records for the gmail.com domain<\/strong>\u00a0because, of course, that\u2019s Google\u2019s. And they already have SPF and DKIM set up.<\/p>\n
So if you\u2019re sending from a gmail.com account, you\u2019re all set. There\u2019s no need for you to do anything in this article.<\/p>\n
What do I do if I don\u2019t control my own domain name?<\/h3>\n
It\u2019s possible that you don\u2019t control your own domain name. For example: Maybe you work for a company and send emails through them.<\/p>\n
In those cases, it\u2019s unlikely that you\u2019ll be able to get into the DNS records yourself to set up your DKIM record.<\/p>\n
So you\u2019ll need to talk to whoever\u2019s in charge<\/strong>\u00a0\u2014 your boss, the IT department, or someone else \u2014 to explain that DKIM is important and they need to set up the record so your emails will be in compliance with Google and Yahoo\u2019s sender requirements.<\/p>\n
Step 1: Getting Your DKIM Key<\/h2>\n
Note: If you use GMass with a third-party SMTP server, follow <\/strong><\/em>these instructions<\/a><\/strong><\/em>\u00a0instead.<\/strong><\/em><\/p>\n
First up, let\u2019s check to see if you already have a DKIM record in place. If so, you won\u2019t have to do any of this.<\/p>\n
How to check if you have a DKIM record<\/h3>\n
You can use GMass\u2019s free email analyzer tool<\/a>\u00a0to figure out whether you already have DKIM set up for your domain.<\/p>\n
Head over to the tool, then grab the email address it gives you.<\/p>\n
Send an email to that address from your email account.<\/p>\n
Once GMass processes the email (should take a few seconds), the screen will show you all the technical details of your email. The Headers<\/strong>\u00a0tab will let you know the DKIM information.<\/p>\n
![\"Finding](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image2-2.png\")
<\/a><\/figure>\nIf you have a valid record, and you\u2019ve never set one up, odds are it\u2019s Google\u2019s default DKIM record.<\/p>\n
Still, it\u2019s smart to still set up your own, especially for deliverability purposes (and if you plan to also set up DMARC and achieve DKIM alignment).<\/p>\n
Also note: You can<\/em>\u00a0have multiple DKIM signatures, perhaps set through Google Workspace and another with an SMTP provider.<\/p>\n
Creating a DKIM record<\/h3>\n
Again: If you use GMass with a third-party SMTP server, follow <\/strong><\/em>these instructions<\/a><\/strong><\/em>\u00a0instead.<\/strong><\/em><\/p>\n
The first step to creating a DKIM record is getting your key from the Google Admin console<\/a>. You\u2019ll need to be logged into the domain as a super administrator<\/strong>; if someone else owns or controls the domain, they\u2019ll need to go through this process.<\/p>\n
But assuming you are the top level administrator, go to the Google Admin console<\/strong>, then go to Apps<\/strong>\u00a0> Google Workspace<\/strong>\u00a0> Gmail<\/strong>.<\/p>\n
![\"Where](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image3-2.png\")
<\/a><\/figure>\nClick Gmail<\/strong>, then scroll down to Authenticate email<\/strong>\u00a0and click.<\/p>\n
![\"Go](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image6-2.png\")
<\/a><\/figure>\nSelect the domain you\u2019re authenticating from the dropdown. Then click Generate New Record<\/strong>.<\/p>\n
In the selection box, choose your settings. Most modern domain providers will take 2048-bit keys, so choose that. And while you could<\/em>\u00a0set your own prefix, going with their default of google<\/strong>\u00a0follows their recommendations. Then click Generate<\/strong>.<\/p>\n
![\"Generating](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image1-2.png\")
<\/a><\/figure>\nGoogle will give you a DNS Host name<\/strong>\u00a0and TXT record value<\/strong>. Keep this window open, because you\u2019ll need those for our next step.<\/p>\n
Step 2: Adding Your DKIM Record to Your Domain<\/h2>\n
Now that you\u2019ve generated your DKIM key, you\u2019re ready to add it to your domain.<\/p>\n
As a beginner, odds are you\u2019re going to enter it at your domain registrar<\/strong>\u00a0(e.g., GoDaddy, Namecheap, and so on). You should start there, anyway; they\u2019ll let you know if they\u2019re not actually managing your Domain Name System (DNS) settings.<\/p>\n
If you\u2019re using a web host, it\u2019s possible they are handing DNS for your domain. If you try to add the DNS record at your registrar and they say someone else is managing it, head over to your web host. (Their support can also help you with this as needed.)<\/p>\n
As a beginner, it\u2019s unlikely there\u2019s a different third-party managing your DNS settings.<\/p>\n
How to input a DKIM record at your domain registrar<\/h3>\n
I\u2019ll show you an example of DNS management here with GoDaddy. While your registrar won\u2019t look exactly like this, the basic concept is the same (go to your domain, go to its DNS settings, add a record).<\/p>\n
Log into your domain registrar<\/strong>, then find your domain. Enter the DNS management settings<\/strong>\u00a0for that domain. Then click whatever link or button you see to add a new record<\/strong>.<\/p>\n
![\"Adding](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image7-1.png\")
<\/a><\/figure>\nNow you\u2019ll enter the following things:<\/p>\n
- \n
- Type: <\/strong>TXT<\/li>\n
- Name\/Host: <\/strong>\u00a0The DNS Host name (TXT record name)<\/em>\u00a0from Google<\/li>\n
- Value: <\/strong>The TXT record value<\/em>\u00a0from Google<\/li>\n
- Time-to-Live (TTL): <\/strong>1 hour or 3600 seconds<\/li>\n<\/ul>\n
Then save<\/strong>\u00a0your new record.<\/p>\n
![\"How](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image5-2.png\")
<\/a><\/figure>\nYou can scroll through the list of DNS records at your registrar. You\u2019ll find your new TXT record there.<\/p>\n
Step 3: Authenticating and Verifying Your DKIM Record<\/h2>\n
Now that you\u2019ve created your DKIM record\u2026 it\u2019s time to wait.<\/p>\n
It can take up to 48 hours for DNS changes to propagate through the internet<\/strong>. In my experience, they don\u2019t usually take that<\/em>\u00a0long, but they do take some time. I usually try in about four hours, then eight hours, then if it\u2019s still not working, the following day.<\/p>\n
Eventually, though, you\u2019ll be able to run Google\u2019s authentication.<\/p>\n
Authenticating in Google Admin<\/h3>\n
Go back to the Authenticate email<\/strong>\u00a0section of the Google Admin console and click the Start Authentication<\/strong>\u00a0button.<\/p>\n
![\"Start](\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2024\/01\/image4-2.png\")
<\/a><\/figure>\nIf you\u2019ve waited long enough (and no one ever waits long enough the first time, don\u2019t feel bad) into the 48-hour period, you should get a success message.<\/p>\n
You can then double-check DKIM<\/strong> using GMass\u2019s email analyzer<\/a>, like you did in step one.<\/p>\n
If You\u2019re Using a Third-Party SMTP Service with GMass<\/h2>\n
If you\u2019re using a third-party SMTP service like Amazon SES, ReachMail, or even GMass\u2019s own in-house option<\/a>\u00a0of SMTPGM, follow the instructions in this article<\/a>\u00a0to set up DKIM through GMass.<\/p>\n
When you go through that process, GMass will be able to pass along your DKIM headers to your SMTP service<\/strong>\u00a0(assuming it\u2019s one that does not strip them out) and you\u2019ll be able to pass DMARC.<\/p>\n
How to Set Up DKIM: Next Steps<\/h2>\n
You have now successfully set up DKIM authentication<\/strong>\u00a0for your domain.<\/p>\n
With that, you are in compliance with <\/strong>Google and Yahoo\u2019s requirements<\/a><\/strong>\u00a0for all senders<\/strong>. (If you\u2019re a bulk sender, you also need SPF and DMARC.)<\/p>\n
And while you\u2019re in your domain registrar editing DNS settings, we might as well set up a few more things to help your deliverability.<\/p>\n
You can set up SPF<\/a>\u00a0even faster than setting up DKIM. And all it requires is adding another TXT record to your domain.<\/p>\n
You should set up DMARC<\/a>, since it works with your SPF\/DKIM records and is a deliverability boost. Setting it up will also just take one more TXT record to your domain.<\/p>\n
And finally, this is a great time to set up a custom tracking domain<\/a>. A custom tracking domain replaces the shared domains for your open tracking, click tracking, and unsubscribe link \u2014 and it can be a major deliverability boost. Once again, all it will take is adding one more DNS record.<\/p>\n
- Name\/Host: <\/strong>\u00a0The DNS Host name (TXT record name)<\/em>\u00a0from Google<\/li>\n
- Type: <\/strong>TXT<\/li>\n
- Step 1: Getting Your DKIM Key<\/a><\/li>\n
- What Is DKIM in Under 100 Words?<\/a><\/li>\n