Setting Up DKIM/DomainKeys in Lyris HQ

Only Administrators with the Edit Global Email Settings permission can set up and edit An email authentication system that gives email providers a way to verify that a message came from you and was not altered by anyone along the way. DKIM/DomainKeys. For information about permissions, see Changing User Permissions.

Tip: For information about setting up DKIM/DomainKeys in EmailLabs, see Setting Up DKIM/DomainKeys in EmailLabs. For information about DKIM/DomainKeys, see DKIM/DomainKeys Overview.

You need to set up DKIM/DomainKeys only if you are using your own address (for example, newsletter@yourdomain.com) or an address set up with domain masking (for example, reply-xxx@email.yourdomain.com). If you are using the default Lyris HQ address (for example, reply-xxx@lyris5.com ) your messages are automatically signed with DKIM/DomainKeys and you do not need to do anything.

Tip: For information about domain masking, see Advanced Email Setup.

About setting up DKIM/DomainKeys in Lyris HQ

To set up DKIM/DomainKeys in Lyris HQ, do the following on the Domain Keys tab of the Edit Organization page:

1. Generate a selector for a domain.

2. Publish the selector to DNS.

To accomplish this, you will need to send the selector to your IT team or the person who handles your DNS record.

3. Optionally, create additional selectors and set a The selector that your email system uses to sign messages. master selector.

Tip: For more information about selectors, see What are selectors?

To open the Domain Keys tab

1. Click Settings.

The System Tools page opens.

2. In the Organizations section, click the name of the organization you want.

The Edit page opens.

3. Select the Domain Keys tab.

What do you want to do?

Learn more about DKIM/DomainKeys and selectors

Set up DKIM/DomainKeys

Publish the TXT DNS record 

Create a selector

Set a master selector

Delete a selector

Verify your DKIM/DomainKeys setup

To set up DKIM/DomainKeys for a domain

1. Open the Domain Keys tab.

2. Make sure Yes is selected in DKIM/Domain Key Signing.

3. Do one of the following:

• Create a new domain:

  a. Click .

  The Add Domain dialog opens.

  b. Type the domain name then click  .

  Note: The domain name must be in the name.com format, for example mydomain.com.

  The domain is added to the list on the left.

  c. Select the new domain from the list.

The selector appears in the field on the right as shown in the following illustration.

4. Publish the TXT DNS record.

Note: The notification message: (No public key in TXT record - verify) appears above the Selector field until the DNS record is updated (approximately 48 hours after the TXT record is published). After the DNS record is updated and if it is correct, this message will change to: Selector: selector_name - DNS record verified. If the record is incorrect, the message will state the problem. In this case, you will need to resolve the problem and publish the TXT record again.

To publish a TXT DNS record

You must publish the selector to a TXT DNS record every time you change the message signature, for example when you add a domain or change the master selector.

1. Open the Domain Keys tab.

2. If it isn't already selected, select the selector you want to publish:

a. In the list on the left, select the domain.

All selectors for the selected domain appear in the Master Selector drop down list.

b. In the Master Selector list, select the selector you want to publish.

3. Copy all text in the Selector field and send it to your IT team or the person who handles your DNS record.

The IT team will need to publish the TXT record to DNS.

Messages sent from this domain will be signed with the new selector after the DNS record is updated (about 48 hours after the TXT record is published.)

How do you know when the DNS record is updated?

On the Domain Keys tab of the Edit Organization page, select the selector you published. You will see the following message above the Selector field: The TXT entry of DNS record for <domain_key_name> has been verified.

To create a selector

Optionally, you can create additional selectors for a domain. You might use multiple selectors, for example, if you want to periodically change the message signature for security reasons.

If you use multiple selectors, the email system will use only one of them, the master selector, to sign your messages. For more information, see Why use multiple selectors?

1. Open the Domain Keys tab.

2. If it isn't already selected, select the domain you want from the domain list on the left.

3. Click  . 

A confirmation message opens.

4. Click OK.

The selector is created and its name appears in the Selector drop down list.

5. Optionally, to set the new selector as the The selector used to sign your messages.master:

a. Click .

A confirmation message opens.

b. Click OK.

The selector is set as the master.

c. Publish the TXT DNS record.

To set a master selector

If you use multiple selectors, you must set one as the master. The master must be the selector published in DNS because it is the only one your email system uses to sign messages. For this reason, when you change the master selector, you must publish a new TXT DNS record.

1. Open the Domain Keys tab.

2. Select the domain you want.

3. In the Selector or Master Selector drop down list, select the selector you want to set as the master.

Note: The name of this list changes depending on which selector currently appears in the Selector field.

The selector appears in the Selector field.

4. Click .

A confirmation message opens.

5. Click OK.

The selector is set as the master.

6. Publish the TXT DNS record.

Note: The notification message: (No public key in TXT record - verify) appears above the Selector field until the DNS record is updated (approximately 48 hours after the TXT record is published). After the DNS record is updated and if it is correct, this message will change to: Selector: selector_name - DNS record verified. If the record is incorrect, the message will state the problem. In this case, you will need to resolve the problem and publish the TXT record again.

To delete a selector

Warning! If you delete a selector, all messages using that selector will fail the signature test. If you think some of these messages might not have been delivered yet, you should keep the selector, create a new one, and set the new selector as the master.

You can not remove the master selector. To remove the master selector, you must first set another one as the master.

1. Open the Domain Keys tab.

2. If it isn't already selected, select the selector you want to remove:

a. In the list on the left, select the domain.

All selectors for the selected domain appear in the Master Selector drop down list.

b. In the Master Selector list, select the selector you want to remove.

3. If the selector is set as the master, set another master selector.

4. Click .

A confirmation message opens.

5. Click OK.

The selector is removed.