DKIM: Sign Your Zoey Emails
Overview
DKIM (DomainKeys Identified Mail) adds a digital signature to the emails Zoey sends from your domain. Inbox providers such as Gmail and Outlook check that signature against a public key in your DNS. It proves the email really came from your domain and wasn't changed on the way, which helps your order, invoice and quote emails reach the inbox instead of spam.
Zoey creates a DKIM key for each of your sender domains. You add one TXT record to your DNS, click Verify, and Zoey signs every email it sends from that domain from then on.
DKIM works alongside SPF; it doesn't replace it. Your domain still needs a valid SPF record that includes Zoey. See SPF: Emails Not Going to SPAM.
Before you start
- Your SPF record must be valid. If a domain's SPF check fails, its DKIM row shows Fix SPF first. Fix SPF, then come back.
- You need access to your domain's DNS, at your domain registrar or DNS host (for example GoDaddy, Cloudflare or Route 53), or someone who can add a record for you.
- The sender must be on your own domain. DKIM can't be set up for free email providers (Gmail, Outlook, Yahoo, iCloud and similar) or for email platforms such as Mailchimp, Klaviyo, SendGrid, HubSpot or Amazon SES. These show Not available for this domain. To sign your Zoey emails, send them from an address on your own domain, set in Settings > Emails.
Set up DKIM
- In your Zoey admin, go to Web Settings > Domain. The DKIM Records row is under SPF Record and lists each domain your store sends email from.
- Next to the domain, click Set Up DKIM. Zoey creates a key, and the status changes to Pending DNS.
- Click Show Record. You'll see the record to add, with a copy button for each part:
| Field | What to enter |
|---|---|
| Type | TXT |
| Host / Name | zoeyYYMM._domainkey, for example zoey2611._domainkey. Copy the exact value shown. |
| Value | Starts with v=DKIM1; k=rsa; p= followed by a long key. Copy the whole value. |
- At your DNS provider, add a new TXT record with that Host and Value. Some providers want the full name (for example
zoey2611._domainkey.yourdomain.com), which is also shown. - Back in Zoey, click Verify. When Zoey finds the record, the status changes to Verified, and emails from that domain are signed from then on.
DNS changes can take anywhere from a few minutes to a few hours to show up. If Verify says the record isn't found yet, wait a while and click Verify again. Nothing breaks while a key is pending: your emails keep going out as before, just unsigned.
The value is longer than 255 charactersDNS records hold text in pieces of up to 255 characters. Most DNS providers split a long value for you, so paste it as one value. If yours doesn't (Amazon Route 53, for example), use the split value Zoey shows under Show Record.
Statuses
| Status | What it means | What to do |
|---|---|---|
| Not set up | No DKIM key yet | Click Set Up DKIM |
| Pending DNS | Zoey made a key and is waiting to find the record in your DNS | Add the TXT record, then click Verify |
| Verified | The record matches. Emails from this domain are signed | Nothing |
| Verified with failed checks | A recent nightly check couldn't find the record. Emails are still signed | Check the record is still in your DNS. Often this clears on its own |
| Failed | The record has been missing or wrong for several days. Emails from this domain are no longer signed | Fix the record and click Verify, or click Set Up DKIM for a new key |
| Fix SPF first | The domain's SPF record isn't valid | Fix SPF. See SPF: Emails Not Going to SPAM |
| Not available for this domain | The domain belongs to an email provider or platform | Send from an address on your own domain |
The Email Domain Info panel, opened from the email domain alert, also shows each domain's DKIM status next to its SPF result, with a Set up DKIM link.
Ongoing checks
Zoey re-checks every DKIM record each night, and when you save your sender email settings. A single missed check doesn't change anything, because DNS lookups sometimes fail briefly. A key only becomes Failed after it has failed checks on three nights in a row. Until then it shows Verified with failed checks and keeps signing. One successful check sets it back to Verified.
Generating, verifying and status changes are recorded in the Email Settings audit log.
Rotate your key
To replace a verified key, click Rotate key. Zoey creates a new key with a new Host name. The current key keeps signing while you add the new record and click Verify. Once the new key is verified, the old key is retired, and after a few days you can delete its old TXT record from your DNS.
Troubleshooting
Verify says "No TXT record found". The record isn't visible yet. Check the Host is exactly what Zoey shows (some providers add your domain automatically, so zoey2611._domainkey becomes zoey2611._domainkey.yourdomain.com; don't enter the domain twice). Then wait for DNS to update and click Verify again.
Verify says the name "resolves to a CNAME, likely a wildcard record". Your DNS has a wildcard record (*.yourdomain.com), often at Cloudflare or your web host, that answers for the DKIM name instead. Adding the TXT record with the exact Host fixes it, because a specific record takes priority over the wildcard.
Verify says the record doesn't match. The Value was cut off or changed when it was pasted. Copy it again with the copy button and replace the whole value. If your provider limits values to 255 characters, use the split value.
Do I still need SPF? Yes. Zoey needs a valid SPF record to send from your domain at all. DKIM adds a second check on top of it.
Does DKIM help with DMARC? Yes. Zoey signs with the same domain as the email's From address, so a verified DKIM key passes DMARC's DKIM check, in addition to SPF.
Can I set up more than one domain? Yes. Each sender domain has its own row, key and record.
What about emails sent before DKIM was verified? They were sent unsigned, as before. Signing starts as soon as the key is verified.
Updated about 2 hours ago