How does individual DKIM versus shared DKIM affect email deliverability?

Key findings

• Reputation isolation: Individual DKIM signatures allow for better isolation of sender reputation. If one sender's practices lead to poor reputation, it is less likely to negatively affect other senders using the same ESP.
• Shared reputation risk: Shared DKIM can lead to reputation smearing, similar to shared IP addresses. Bad sending practices by one user can negatively impact the deliverability of all others using that shared signature.
• Improved tracking: DKIM's primary purpose is to allow more accurate tracking of mail streams, which benefits senders with good practices.
• ISP trust: Mailbox providers are more likely to trust emails signed with an individual DKIM key that aligns with the sending domain, leading to better inbox placement.
• Domain authentication strength: While shared DKIM provides some level of authentication, individual DKIM provides a stronger, more direct link between the sender's domain and the email, which can lead to higher trust scores.

Key considerations

• Mail flow quality: The impact of shared DKIM depends heavily on the overall quality and volume of mail flow using that shared signature. High-quality sending practices from all users can mitigate some risks.
• Provider's responsibility: Email Service Providers (ESPs) using shared DKIM must actively manage their shared reputation and enforce strict sending policies to protect their customers. As organizations must avoid widespread sharing.
• Complexity for ESPs: Offering individual DKIM to all users can add complexity for ESPs, but it provides a significant deliverability advantage to their clients.
• Authentication alongside SPF and DMARC: DKIM works in conjunction with SPF and DMARC to build a comprehensive authentication framework. Understanding how these protocols interact is vital for overall email deliverability.

Key opinions

• Preference for individual signing: Many marketers prefer to sign emails with their own domain, believing it offers better control and transparency over their sending reputation.
• Reputation alignment: A custom domain that matches the sending domain promotes brand consistency and trust, which directly aids email deliverability.
• DKIM for trust: Marketers view DKIM as a fundamental tool to enhance trust with ISPs and improve overall inbox placement, preventing emails from landing in spam folders.
• Multiple DKIM records: It is feasible to have separate DKIM records for each email service used, provided the host names are distinct.

Key considerations

• Balancing priorities: While individual DKIM is ideal, some marketers may prioritize other deliverability factors, such as shared URLs or header sender URLs, viewing them as more immediate concerns.
• Impact on domain reputation: Turning on DKIM directly impacts domain reputation and deliverability by verifying sender identity.
• Avoiding spam folders: Proper DKIM implementation is a key strategy for marketers to prevent emails from being flagged as spam and ensure they reach the inbox.
• Provider limitations: Some marketers express frustration with ESPs that default to shared DKIM, advocating for individual solutions despite potential implementation challenges.

Key opinions

• Analogy to IPs: Shared versus individual DKIM 'd=' values should be viewed similarly to shared versus dedicated IPs, where reputation can be significantly smeared across users.
• Benefit for good senders: The core purpose of DKIM is to allow more precise tracking of mail streams, which inherently benefits legitimate senders with good practices by ensuring their reputation is accurately attributed.
• Provider's own key: As a provider, signing with your own DKIM key is crucial for managing feedback loops (FBLs) and overall service reputation.
• Enhanced trust for ISPs: Enabling DKIM helps enhance trust from ISPs, contributing to better email deliverability and improved sender reputation.

Key considerations

• Quality and volume: The deliverability impact of shared DKIM is contingent on the overall quality and volume of mail flow using the associated shared IP range. Poor sending behavior can quickly degrade shared reputation.
• Mitigating bad actors: If a shared system is used by various clients, including those with questionable sending practices (e.g., performance marketing armies), it can adversely affect dedicated customers.
• Custom domain importance: Experts recommend senders sign with their own domain whenever possible to maintain control over their unique sender reputation. This directly relates to how an ESP's shared domain affects reputation.
• Understanding DKIM's role: The full potential of DKIM is realized when it enables more accurate tracking, ultimately benefiting good senders by distinguishing them from malicious actors, as discussed on Server Fault regarding multi-source sending.

Key findings

• Origin verification: DKIM's primary function is to sign message headers and the body, allowing recipients to validate the message's origin and ensure it hasn't been tampered with during transit.
• Anti-spoofing: A DKIM signature helps mailbox providers verify the sender's authenticity, effectively preventing phishing attacks and email spoofing.
• Deliverability factor: DKIM is a key factor for mailbox providers in deciding whether to block emails, filter them into spam folders, or deliver them to the inbox.
• Holistic authentication: When combined with SPF and DMARC, DKIM forms a comprehensive framework that authenticates emails, improves deliverability, and protects domains from misuse.

Key considerations

• Alignment importance: DKIM alignment is crucial; when it fails, it can negatively impact deliverability, making it essential to avoid widespread sharing of a single DKIM record where alignment cannot be strictly controlled.
• Content integrity focus: While SPF verifies the sender's server, DKIM specifically focuses on the integrity of the email content, ensuring it remains unaltered after being signed.
• Reduced threats: Together, DKIM, SPF, and DMARC significantly reduce threats like spoofing, phishing, and spam.
• Absence of DKIM: Even when SPF is passing and DMARC is aligned, the absence of DKIM can still affect deliverability by weakening authentication signals.