Publish your DKIM record

Smailor signs outgoing messages with a private DKIM key. You publish the matching
public key in DNS so receiving providers can verify those signatures.

This task does not require you to generate a key. Smailor provides the selector,
record name, and value for your domain.

To see what your domain publishes right now (SPF, DMARC and common DKIM selectors),
use the free domain check. It needs no account.

What DKIM proves

Smailor signs with private key
              |
              v
        Message is sent
              |
              v
Receiver reads selector from DKIM-Signature
              |
              v
Receiver fetches public key from DNS and verifies signature

The public key is designed to be visible in DNS. The private key must remain
secret and never appears in the record you publish.

Before you start

You need:

• a domain already added in Settings → Domains;
• access to the DNS provider for that domain;
• the DKIM record displayed in the domain's Deliverability section.

Identify the authoritative DNS provider first. It may be different from the
company where the domain was purchased.

Copy the record from Smailor

Open Settings → Domains → your domain → Deliverability and locate DKIM.
Smailor shows three important pieces:

Copy each field with the dashboard's copy control. Do not copy the illustrative
values above.

Add the TXT record

1. Open the DNS zone for the exact domain.
2. Create a new TXT record.
3. Paste the host/name shown by Smailor.
4. Paste the entire value, including v=DKIM1 and the full p= value.
5. Keep the provider's default TTL unless you have a planned DNS rollout.
6. Save the record.

DNS providers handle the host field differently:

• a provider that automatically appends example.com may expect only
  smailor._domainkey;
• a provider that expects a fully qualified name may require
  smailor._domainkey.example.com;
• some providers display or store the long value as adjacent quoted chunks.
  That is valid when the concatenated public value remains unchanged.

Never add manual line breaks, smart quotes, backslashes, or spaces inside the
public key material.

Verify in Smailor

1. Return to the domain's Deliverability section.
2. Select Verify DNS.
3. Check the DKIM row specifically.

Verification can succeed within minutes, but cached DNS may take 24–48 hours to
expire. Smailor must be able to retrieve the expected public value; seeing it in
the DNS provider's form is not enough.

Confirm with a real message

After Smailor reports DKIM as verified:

1. Send from the domain to an external mailbox you control.
2. Open the message's original source or authentication details.
3. Find DKIM-Signature and note its d= domain and s= selector.
4. Confirm the provider reports dkim=pass.
5. Confirm DMARC also passes for the visible From domain.

DNS verification proves the public key is reachable. A real-message test proves
that the outgoing message was signed and the signature survived delivery.

What the verified badge does and does not mean

The DKIM row in Settings → Domains → Deliverability answers one question:
does the TXT record at your selector hold the public key that matches the private
key Smailor holds for this domain?

It does not report on the last message you sent. These are three different
outcomes, and only the first is a healthy one:

The third case is not a DNS problem and nothing you change in your zone will fix
it. Report it with the full headers.

Troubleshooting

Record not found

• Query the complete hostname shown by Smailor.
• Confirm you edited the authoritative DNS zone.
• Check whether your provider appended the domain twice.
• Wait for negative DNS caching to expire after creating a new record.

Record found but verification fails

• Compare the full value with Smailor character for character.
• Check that the p= value was not truncated.
• Remove decorative quotes copied from documentation; let the DNS interface
  handle storage formatting.
• Confirm there is not an older record at the same selector.

DKIM passes but DMARC fails

DKIM authentication and DMARC alignment are different checks. The signing
domain in d= must align with the visible From domain for DKIM to satisfy DMARC.
Review the message headers and email authentication guide.

Smailor shows a new selector

Treat it as a key rotation:

1. Add the new selector without deleting the old one.
2. Wait for the new selector to verify.
3. Send a test message and confirm the new signature passes.
4. Remove the old selector only when Smailor marks it as retired.

Keeping both selectors temporarily allows messages signed before the rotation to
remain verifiable.

Security checklist

• Only the public p= value is in DNS.
• No private key was copied into a ticket, chat, or document.
• The hostname matches the domain configured in Smailor.
• Smailor reports DKIM as verified.
• A real external message reports dkim=pass.
• DMARC aligns with the visible From domain.

Related guides

• Email authentication
• Add a custom domain
• Read delivery statistics