PSA for people with their own email domain: Google is rejecting mail without DKIM

[squirrelitude]

Somewhere in the past days or weeks, Google started either bouncing email without a DKIM signature or is silently filing it as spam. (DKIM: DomainKeys Identified Mail, an anti-spoofing measure.)

If you receive email at a domain you registered, there is a good chance that recipients who use Google Mail are not receiving it. You'll need to ensure that you're getting a DKIM "pass" result that matches your domain name.

For example, I use Fastmail. GMail was indicating "DKIM PASS from messagingengine.com" (that's Fastmail's actual mail service) but was still rejecting my mail. Once I added the DNS records that Fastmail indicating I needed to add in their settings page for my domain, I instead started getting "DKIM PASS from [my actual domain]" and my mail started getting through.

(While DKIM is a reasonable tool and it's fine that Google is using this as part of their spam check, I suspect they're doing this strict version to try to solidify their position by further freezing out other mail providers.)

Comments

[squirrelitude]

DKIM is... pretty technical and kind of hard to evaluate directly. I don't actually know a ton about it. But this looks like the best way of doing it:

1. Go to https://www.appmaildev.com/en/dkim and click the "Next Step" button at the top
2. It will give you an email address. Send an email to that address from the domain you want to check
3. It will then give you a report. Find the DKIM section and expand it. Two things need to be true: It needs to say "PASS" in the summary of that section, and the big blob of text that starts with "DKIM-Signature" needs to contain "d=example.com" (if your mail is blah@example.com). If it contains something else like d=dreamhost.com, that's something that Google will frown at.

Chances are decent that Dreamhost is handling DKIM correctly -- if they control your DNS records (e.g. if you registered the domain through them) then they have the ability to set everything up correctly. And maybe they have!

If your domain name itself is managed elsewhere (with A and MX records pointing to Dreamhost) then it is likely *not* set up for DKIM.

[yarrowkat]

this is SUPER helpful, thank you! DreamHost controls our DNS. i remember that specifically because it was a GIANT fight to get it away from my ex and into a place where he didn't have a password/any kind of access (beyond that of the general public to any website) to it. he was, without overtly saying so, holding all of my 14 years of intellectual property on our website hostage. (i have done 99% of the writing, 100% of the photography, and i was the only steward actively engaged in revising the layout & design of the website when we revamped it a few years back with the help of a web designer; i am the only person who maintains it. hence DreamHost, which does a lot of work in the background for me!)

i'll go run this lil' email test now. thank you!

[yarrowkat]

it works! it says DKIM pass on the site you provided, and it shows the signature as coming from sunflowerriver.org.