How to set up DKIM for bulk email

DKIM is your domain's signature on an email: the provider uses it to check that the message was sent by you and not altered on the way. Estismail creates the DKIM key itself when you add a domain. You only need to add one TXT record to the domain's DNS, with the name estismail._domainkey and the value from your account.

Why DKIM matters

• Mail.ru, Gmail and Yandex require a DKIM signature on bulk email. Without it, emails go to "Spam" or get rejected.
• Emails from Estismail go out with two signatures: your domain's and ours. Your domain's signature appears once you add the DKIM record.
• In Estismail, the DKIM record verifies your domain (just like the SPF record).

How to add the record

1. Open Sender settings → Domains and select the domain.
2. Click the DKIM row to expand it. The value is in the field: select all of it and copy.
3. In your domain's DNS panel, create a record:

Each domain has its own key. Do not copy the value from someone else's guide or from another domain. If you delete the domain and add it again, the key will be new, and you will have to replace the DNS record.

Common errors

• Domain twice in the name. Many DNS panels append the domain to the record name themselves. If you enter estismail._domainkey.company.com, you get estismail._domainkey.company.com.company.com. Enter only estismail._domainkey.
• Value truncated or split. The key is long, so copy all of it, from v=DKIM1 to the last character. Spaces and line breaks inside break the signature. If your DNS panel splits a long value into quoted parts itself, that is fine.
• Wrong record type. It must be TXT. A CNAME record with this name will not work.
• Old key. If your account says "Key does not match the key in your account", DNS still holds the previous value. Replace it with the one currently in your account.
• Subdomain. For the subdomain news.company.com your account shows the same name estismail._domainkey. In the DNS panel of the main domain, enter estismail._domainkey.news.

How to check

• In your account, the domain's DKIM label is green.
• The "Check again" button checks the records immediately. Estismail itself checks the domain every 10 minutes.
• A new DNS record is usually visible within an hour, sometimes longer.

DKIM and strict DMARC

If the domain has the DMARC policy p=quarantine or p=reject, then without a DKIM record providers will reject or send to "Spam" emails from this domain. This has happened: a domain had p=reject, no DKIM record, and Mail.ru rejected every email in the campaign. In that case your account shows the DMARC label in red. So add DKIM first, wait for the green label, and only then launch the campaign. More in the article DMARC for campaigns.

DKIM and Mail.ru Postmaster

Mail.ru Postmaster shows domain statistics based on the DKIM signature, not the From address. When the Estismail DKIM record works, emails are signed with your domain, and you can connect it to Postmaster: you see how many emails reached the inbox, how many went to "Spam" and how many drew complaints. How to connect it and read the numbers: Mail.ru Postmaster.

What's next

• SPF for campaigns
• DMARC for campaigns
• How to connect a domain and sender address
• Term: DKIM in the glossary