PSA for people with their own email domain: Google is rejecting mail without DKIM

[squirrelitude]

Somewhere in the past days or weeks, Google started either bouncing email without a DKIM signature or is silently filing it as spam. (DKIM: DomainKeys Identified Mail, an anti-spoofing measure.)

If you receive email at a domain you registered, there is a good chance that recipients who use Google Mail are not receiving it. You'll need to ensure that you're getting a DKIM "pass" result that matches your domain name.

For example, I use Fastmail. GMail was indicating "DKIM PASS from messagingengine.com" (that's Fastmail's actual mail service) but was still rejecting my mail. Once I added the DNS records that Fastmail indicating I needed to add in their settings page for my domain, I instead started getting "DKIM PASS from [my actual domain]" and my mail started getting through.

(While DKIM is a reasonable tool and it's fine that Google is using this as part of their spam check, I suspect they're doing this strict version to try to solidify their position by further freezing out other mail providers.)

Comments

[wpadmirer]

My email domain is hosted with a local ISP, and so far I haven't had any trouble getting my emails through. I appreciate the warning! I'll definitely keep an eye out for that.

Damn gmail!

[yarrowkat]

would you be willing to walk me through the implications of this for someone using DreamHost? it hosts our website (using wordpress) & its associated email domain. i am not a tech person - have been described as a "competent end-user" by the tech people in my life. so i usually don't know *how* the thing actually works, but can often *make* it work with some guidance. :)

[squirrelitude]

DKIM is... pretty technical and kind of hard to evaluate directly. I don't actually know a ton about it. But this looks like the best way of doing it:

1. Go to https://www.appmaildev.com/en/dkim and click the "Next Step" button at the top
2. It will give you an email address. Send an email to that address from the domain you want to check
3. It will then give you a report. Find the DKIM section and expand it. Two things need to be true: It needs to say "PASS" in the summary of that section, and the big blob of text that starts with "DKIM-Signature" needs to contain "d=example.com" (if your mail is blah@example.com). If it contains something else like d=dreamhost.com, that's something that Google will frown at.

Chances are decent that Dreamhost is handling DKIM correctly -- if they control your DNS records (e.g. if you registered the domain through them) then they have the ability to set everything up correctly. And maybe they have!

If your domain name itself is managed elsewhere (with A and MX records pointing to Dreamhost) then it is likely *not* set up for DKIM.

[yarrowkat]

this is SUPER helpful, thank you! DreamHost controls our DNS. i remember that specifically because it was a GIANT fight to get it away from my ex and into a place where he didn't have a password/any kind of access (beyond that of the general public to any website) to it. he was, without overtly saying so, holding all of my 14 years of intellectual property on our website hostage. (i have done 99% of the writing, 100% of the photography, and i was the only steward actively engaged in revising the layout & design of the website when we revamped it a few years back with the help of a web designer; i am the only person who maintains it. hence DreamHost, which does a lot of work in the background for me!)

i'll go run this lil' email test now. thank you!

[yarrowkat]

it works! it says DKIM pass on the site you provided, and it shows the signature as coming from sunflowerriver.org.

[squirrelitude]

Info from DreamHost on how to see if DKIM is set up: https://help.dreamhost.com/hc/en-us/articles/215029758-What-are-DKIM-records-

...but the gold standard is still to send an email and check if the receiving server sees valid DKIM. :-)

(I'd also be happy to help out and take a look more directly if none of the above helps.)

[thewayne]

Hmmmm. I have several private domains, I don't normally send email from them, but I receive lots. I should test them at some point.

Thanks for the info!