🛡 The DKIM Guard: Rotate Only Through Authenticated Senders

Every email you rotate says it is from your domain, so every provider in the pool must be authorised to send for that domain, through DKIM or SPF. A provider that is not authorised fails DMARC on the emails it sends. The DKIM guard checks each connection for you and, if you want, keeps rotation to the ones it can confirm.

Where to find it:

Open Delivery, then Sending, and scroll to the Send Rotation & Warmup card. You will find:

• the Strict DKIM guard tick box, under the three modes,
• the Authentication column in the connections table,
• the Re-check authentication button under the table.

Reading the Authentication badges:

• Green with a tick and your domain, for example "✓ yoursite.com": your domain's DNS shows this provider is authorised, through its DKIM record or your SPF record.
• Amber with a question mark and your domain, for example "? yoursite.com": DNS could not confirm it. This is not a failure. Several providers, Amazon SES among them, use selector names unique to your account that no checker can guess. If the provider's own dashboard shows your domain verified, you are fine.
• "? no domain": no From address could be found for the connection, so there is no domain to check.

Hover over a badge to see the detail, for example which DKIM selector was found or which SPF include proved it.

What the check looks at:

• The domain checked is the connection's own From email, or your default From when the connection has none.
• For a named provider, it looks for that provider's usual DKIM selectors on your domain, then for that provider in your domain's SPF record.
• For a Bring-your-own SMTP connection, it looks for your domain's own DKIM key, the same check the Deliverability tab runs, because your own server signs the mail.
• When Strict DKIM guard is on and an email is being sent, the domain checked is the one in that email's From.
• Results are kept for 12 hours, so the page stays quick.

Re-check authentication:

After you change DNS records, click Re-check authentication. It checks every active connection again straight away, ignoring the 12 hour memory, updates the badges, and says how many are verified and how many unconfirmed.

Strict DKIM guard:

Tick Strict DKIM guard and click Save rotation & warmup, and only green connections take part in rotation.

• Amber connections are not dropped. They move to the back of the line as failover, so if every green connection has trouble with an email, an amber one still delivers it. No email is ever lost to the guard.
• If no connection is green, the Mailer simply sends in priority order, exactly as if rotation were off.
• The guard only changes rotation. In Priority + failover mode it has no effect.

Leave strict mode off if your providers verify domains their own way and their dashboards show your domain as verified. Turn it on once every connection you rely on shows green.

Setting it up, step by step:

1. Authenticate your domain at each provider in the rotation, using the records each provider gives you. See the Connect article for each provider.
2. Check your domain on the Deliverability tab. See Deliverability: SPF, DKIM And DMARC.
3. On Delivery, then Sending, click Re-check authentication.
4. If every connection you rely on is green, tick Strict DKIM guard and click Save rotation & warmup.
5. If one stays amber, check that provider's dashboard. If it shows your domain verified, you can leave strict mode off with confidence.

A real example:

Leafwise Gardening rotates through Amazon SES, SMTP2GO and Postmark, all sending as anna@yoursite.com. All three badges show "? yoursite.com" in amber: Amazon SES uses account specific DKIM selectors, and the others have not been confirmed from DNS yet. Each provider's own dashboard shows yoursite.com as verified, so Anna leaves Strict DKIM guard unticked. When she later adds a mail server of her own, its badge turns green as soon as yoursite.com publishes its DKIM key.

Tips:

• Authenticate the domain at a provider before you add it to the rotation.
• Click Re-check authentication after every DNS change rather than waiting 12 hours.
• Use the same From domain on every connection in the rotation, or switch "Who the email says it is from" to Each connection's own From. See SMTP Rotation: Spread Sends Across Many Connections.
• For the records themselves, see Deliverability: SPF, DKIM And DMARC.

If something does not look right:

• If a badge stays amber after you added the records, wait a few minutes for DNS to spread, then click Re-check authentication. Hover over the badge for the detail.
• If a badge says "? no domain", give the connection a From email on your domain, or set a default From address in the plugin's settings.
• If strict mode leaves a connection idle, it is amber. Confirm the domain in that provider's dashboard and leave strict mode off, or add the provider's DKIM records so it turns green.