DKIM: what it is and why your email needs it

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email that proves the message actually came from your domain and wasn't altered in transit. For hosted domains on Flashcloud, DKIM is configured automatically when your domain points at us, so most customers never touch it. If you're seeing mail land in spam or fail authentication checks, the fix is usually to confirm the DKIM record is published and matches what the mail server is signing with, not to set DKIM up from scratch.

What DKIM actually does

Every message your server sends gets signed with a private key. The signature covers key parts of the message (headers, body, or both) and gets added as a DKIM-Signature header. The receiving mail server looks up a matching public key published as a TXT record on your domain's DNS, usually at a hostname like selector._domainkey.yourdomain.com, and uses it to verify the signature.

If the signature checks out, the receiving server knows two things: the message really was sent by a server authorized to sign for your domain, and nothing in the signed content was changed after signing. If someone forges a message claiming to be from you, they can't produce a valid signature without your private key, so it fails DKIM and gets treated with more suspicion.

Why it matters for deliverability

DKIM alone doesn't guarantee inbox placement, but its absence hurts you. Gmail, Outlook, and most major providers weigh authentication signals (DKIM, SPF, and DMARC) heavily when deciding whether to deliver, flag, or reject a message. A domain sending mail with no DKIM signature looks less trustworthy than one with a clean, passing signature, especially for cold outreach, transactional email, or anything sent in volume.

DKIM also protects your reputation from certain kinds of spoofing. Without it, there's nothing stopping another server from sending mail that claims to be from your domain in the "From" header. With a valid DKIM signature (and SPF and DMARC backing it up), receiving servers have real signals to reject those forgeries instead of letting them damage your domain's sending reputation.

How Flashcloud sets it up

DKIM is auto-configured for hosted domains on Flashcloud, along with SPF. When you create an email account through Services → your hosting → the Email tile (see creating email accounts on your domain), the DKIM signing key and its matching DNS TXT record are handled for you. You don't need to generate a key pair or publish a selector record manually for standard hosted-domain email.

This is separate from DMARC, which is not automatic and layers on top of SPF and DKIM to tell receiving servers what to do when a message fails those checks. If you want DMARC enforcement, that's a policy you add yourself once SPF and DKIM are confirmed working.

Checking alignment

"Alignment" means the domain in your DKIM signature matches the domain in your visible "From" address closely enough for DMARC purposes. A few practical checks:

• Send a test message to a Gmail address, open it, and check "Show original" (or the equivalent in another client). Look for dkim=pass next to the Authentication-Results header.
• Confirm the signing domain (the d= value in the DKIM-Signature header) matches your sending domain, not a third-party relay's domain.
• If you're sending through a third-party service (a marketing platform, a transactional email API) in addition to your Flashcloud-hosted mailboxes, that service needs its own DKIM record added to your DNS. Flashcloud's auto-configured DKIM only covers mail sent from your Flashcloud-hosted mail accounts.

If DNS for your domain isn't pointed at Flashcloud yet, DKIM records won't resolve for external checkers even though the account is configured correctly on our end. This is the same timing issue covered for mail server hostnames in email server settings (IMAP and SMTP) and generally resolves once DNS propagates.

When DKIM checks keep failing

A few things break DKIM after it's working: editing DNS records manually and accidentally removing or altering the DKIM TXT record, moving a domain's nameservers away from Flashcloud without re-adding the DKIM record at the new provider, or sending through a service that rewrites message content after signing (which invalidates body-hash signatures). Forwarding can also break DKIM in some cases, since forwarding servers sometimes modify headers.

None of this affects how many accounts you can run or your storage limits, covered in how many email accounts can I create?, or which protocol you use to read mail, covered in POP3 vs IMAP. It's purely about how outgoing mail gets authenticated.

When to contact support

If a DKIM check keeps failing after DNS has had time to propagate, or you're not sure whether your DKIM record is the one Flashcloud publishes versus a leftover from a previous host, open a ticket from the portal under Support → New ticket. A real person can pull your domain's actual DNS records and confirm what's published against what should be there, which is faster than guessing from the outside.