Summary
To achieve DMARC compliance while using DKIM to sign emails with different 'Header From' domains, the core requirement is ensuring DKIM alignment. This involves configuring DKIM for each domain used in the 'Header From' field, generating unique DKIM keys and DNS records for each, and ensuring the DKIM signature's 'd=' tag aligns with the respective 'Header From' domain. Mail servers must be configured to select the appropriate DKIM key based on the 'Header From' domain. DMARC relies on either DKIM or SPF to pass authentication, with DKIM alignment being key. ESPs may use multiple keys, including client-branded and network-level keys. Platforms like Google Workspace and Exchange Online provide specific configurations to manage DKIM for multiple domains.
Key findings
- DKIM Alignment: DKIM signatures must align with the 'Header From' domain to pass DMARC authentication.
- Unique DKIM Keys: Each 'Header From' domain requires its own DKIM key for proper signing.
- DNS Configuration: Correct DNS records for each domain are essential for DKIM validation.
- Mail Server Configuration: Mail servers need configuration to select the right DKIM key based on the 'Header From' domain.
- DMARC Requirements: DMARC requires either DKIM or SPF to align; DKIM alignment is achieved if the 'd=' value matches the 'Header From' domain.
- ESP Practices: Many ESPs use multiple DKIM keys, including client-branded and network-level keys.
Key considerations
- Domain Setup: Ensure each domain has properly configured DKIM records.
- Key Management: Implement a system to manage and select the correct DKIM key for each email based on the 'Header From' domain.
- Testing: Test your DKIM setup for each domain to ensure proper configuration and alignment.
- Platform-Specific Settings: Utilize platform-specific settings (e.g., in Google Workspace or Exchange Online) to configure DKIM for multiple domains.
- SPF Setup: While DKIM alignment is critical, make sure SPF records are appropriately set up for your sending domains, as DMARC requires one of DKIM or SPF to align.
- DMARC Enforcement: Building towards full DMARC enforcement can be complex and requires planning.
- Second Key: When thinking of adding a second DKIM key, ensure that the domain to be used with the key is consistent across your various mail servers.
What email marketers say
11 marketer opinions
To comply with DMARC when using different 'Header From' domains, it's essential to ensure DKIM alignment. This involves setting up DKIM for each domain, generating unique DKIM keys and DNS records, and ensuring the DKIM signature aligns with the corresponding 'Header From' domain. DMARC requires either DKIM or SPF to pass alignment, and if the DKIM signature's 'd=' value matches the 'Header From' domain, it passes alignment. Proper configuration of mail servers to select the correct DKIM key based on the 'Header From' domain is crucial.
Key opinions
- DKIM Alignment: DKIM signatures must align with the 'Header From' domain to pass DMARC authentication.
- Unique DKIM Keys: Each 'Header From' domain requires its own DKIM key.
- DNS Records: Proper DNS records for each domain are necessary for DKIM validation.
- Mail Server Configuration: Mail servers need to be configured to select the appropriate DKIM key based on the 'Header From' domain.
- DMARC Compliance: DMARC requires alignment with either DKIM or SPF; DKIM can pass alignment if the 'd=' value matches the 'Header From' domain.
Key considerations
- Domain Setup: Ensure each domain has properly configured DKIM records.
- Key Selection: Implement a mechanism to select the correct DKIM key for each email based on the 'Header From' domain.
- DMARC Policy: Monitor DMARC reports to identify and address any authentication issues.
- SPF Configuration: While DKIM alignment is crucial, also ensure SPF records are properly configured for your sending domains as DMARC requires only one of DKIM or SPF to align.
- Accepted Domains: For services like Exchange Online, configure DKIM for each accepted domain you intend to use.
Marketer view
Email marketer from UltraSMTP.com explains that when sending from multiple domains, each domain needs to have its own DKIM record. Configure DKIM in your UltraSMTP account and then publish the DKIM record in your domain's DNS.
13 Jun 2024 - UltraSMTP.com
Marketer view
Marketer from Email Geeks explains that if DKIM's d= value is the same as your Header-From domain (or a root domain of it if having the adkim tag set to relaxed), you're fine for alignment. DMARC only needs alignment with either SPF or DKIM to pass, not for both.
5 Jan 2024 - Email Geeks
What the experts say
4 expert opinions
To comply with DMARC using DKIM when employing different 'Header From' domains, it's crucial that the DKIM signature aligns with the 'Header From' domain for each email. This involves having individual DKIM keys for each domain and ensuring the email is signed with the correct key corresponding to the 'Header From' domain in use. ESPs may also use multiple keys, including client-branded and network-level keys.
Key opinions
- DKIM Alignment is Key: The DKIM signature must align with the 'Header From' domain to achieve DMARC compliance.
- Separate DKIM Keys: Each 'Header From' domain needs its own DKIM key.
- Multiple Keys Are Possible: ESPs may use multiple DKIM keys, including client-branded and network-level keys.
- Long-Term Goal: Building towards full DMARC alignment is a process and a long-term goal.
Key considerations
- Key Management: Implement a system to manage and select the correct DKIM key for each 'Header From' domain.
- DMARC Enforcement: Be aware that achieving full DMARC enforcement can be tricky and requires careful planning.
- Consistent Configuration: Ensure your mail servers are consistently configured to use the correct DKIM keys.
- Second Key: When thinking of adding a second DKIM key, ensure that the domain to be used with the key is consistent across your various mail servers.
Expert view
Expert from Word to the Wise (Laura Atkins) discusses that for DMARC compliance with DKIM, the domain in the DKIM signature ('d=' tag) needs to align with the 'Header From' domain. If you are using multiple 'Header From' domains, each must have properly configured DKIM signatures associated with them.
11 Dec 2024 - Word to the Wise
Expert view
Expert from Email Geeks explains that DKIM (Signature) would help as long as it aligns with the domain you're trying to protect with DMARC (DNS Entry). This would create an unaligned DMARC, which is ok for some, and can potentially be tricky to get to enforcement, and looking to build towards full alignment is something you should do longer term.
11 Aug 2021 - Email Geeks
What the documentation says
5 technical articles
To properly use DKIM to sign emails with different 'Header From' domains and maintain DMARC compliance, the consensus is that the DKIM signature must align with the specific 'Header From' domain for each email. This involves configuring DKIM for each domain, generating unique DKIM keys, and ensuring the 'd=' tag in the DKIM header validates against the 'Header From' domain. Different platforms like Google Workspace and Exchange Online provide specific configurations to manage DKIM for multiple domains.
Key findings
- DKIM Alignment: DMARC compliance hinges on the alignment between the DKIM signature and the 'Header From' domain.
- Unique Keys per Domain: Each 'Header From' domain requires its own DKIM key for proper signing.
- Validating the 'd=' Tag: The DKIM signature must validate against the domain specified in the 'd=' tag of the DKIM header.
- Platform-Specific Configuration: Platforms like Google Workspace and Exchange Online offer tools to manage DKIM for multiple domains.
Key considerations
- Domain Configuration: Ensure that each domain has its DKIM settings configured correctly according to platform-specific instructions.
- Authentication Process: The DKIM signature authenticates the message content and specific headers, including the 'Header From' field.
- Multiple Accepted Domains: For environments like Exchange Online, ensure that you have multiple accepted domains configured to sign emails with different 'Header From' domains.
Technical article
Documentation from Microsoft.com details how Exchange Online uses DKIM. To sign different Header From domains you must have multiple accepted domains and configure DKIM for each accepted domain. Exchange Online signs messages that originate from your domain with DKIM and validates incoming messages.
16 Apr 2022 - Microsoft.com
Technical article
Documentation from Google Workspace Admin explains the process of setting up DKIM for your domain within Google Workspace. To use DKIM with different 'Header From' domains hosted on Google Workspace, generate DKIM keys for each domain and enable signing in the Google Workspace admin console.
18 Feb 2023 - support.google.com
Can DKIM be set up on a subdomain, and which domain should be used for signing?
Do DKIM selectors affect email reputation?
Do SPF and DKIM records need to be aligned for all email service providers?
How can I use DMARC to prevent spammers from using my domain?
How do I sign DKIM on a sender domain that isn't the primary domain while using Hubspot?
What are SPF, DKIM, and DMARC, and when are they needed?
