Email deliverability
What is DKIM, and how do you set it up?
DKIM adds a digital signature to every email you send. The receiving server checks that signature against a public key in your DNS, which proves the message came from your domain and wasn't changed on the way. Without it, your mail is more likely to land in spam.
How it works
- Your mail server signs each outgoing message with a private key that only it holds.
- The signature travels in a
DKIM-Signatureheader. It names your domain (d=) and a selector (s=). - The receiving server uses those two values to find your public key in DNS, at
selector._domainkey.yourcompany.com. - If the signature matches, DKIM passes. If the message was altered or the key is wrong, DKIM fails.
What the record looks like
Name: dkim._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=(your public key)
| Part | Meaning |
|---|---|
dkim | The selector. Each sending service uses its own, so several can sign mail for one domain. |
_domainkey | A fixed label that marks the record as a DKIM key. |
v=DKIM1 | The record version. |
k=rsa | The key type. |
p=… | The public key. It is safe to publish. Never share the private key. |
DKIM, SPF and DMARC
| Record | Question it answers |
|---|---|
| SPF | Is this server allowed to send for the domain? |
| DKIM | Was this message signed by the domain and left unchanged? |
| DMARC | What should happen when those checks fail or don't match the From address? |
Common problems
- Record not found. Some DNS panels add your domain to the name for you. If your check looks for
dkim._domainkey.yourcompany.com.yourcompany.com, enter onlydkim._domainkey. - Key broken into pieces. Long keys can be split across several quoted strings. Paste the value exactly as given, with no extra spaces.
- DKIM passes but DMARC fails. The signing domain must match the From address. A billing or marketing tool that signs with its own domain needs its own DKIM setup on yours.
- Mail changed in transit. Some forwarders and mailing lists alter messages, which breaks the signature.
On SyncGaze Mail
SyncGaze creates your DKIM key for you. Open Domains in the dashboard, copy the record to your DNS provider, and press Verify. Every message is then signed automatically. Check your domain to confirm it works.
Verify and test
- Wait 5–30 minutes after saving. Most changes show up within minutes, but some take up to a few hours.
- Go back to dashboard.syncgaze.in → Domains and click Verify. Each record turns green when SyncGaze can see it.
- Run a free check on mail.syncgaze.in/check. It reads your MX, SPF, DKIM and DMARC records and explains anything still missing.
- Send a test email to a Gmail address and open Show original. It should show
SPF: PASS,DKIM: PASSandDMARC: PASS.
Rather not touch DNS yourself?