Why do I Have to Verify my Domain With DKIM to Send Emails?

Table of contents

• Why Domain Authentication is Required
• What are DKIM and DMARC?
• Step-by-Step Process for Authenticating Your Domain in Keap
• Additional help/FAQs
   

Why Domain Authentication is Required

Major mailbox providers including Google, Yahoo, and Microsoft now require authenticated sending domains to strengthen ecosystem security and reduce spam, phishing, and spoofing. These requirements ensure that only verified senders can deliver mail at scale and that users are protected from impersonation attacks.

Keap aligns with these industry standards to maximize your deliverability and safeguard your sending reputation. To comply, you must send from a custom domain that is fully authenticated with DKIM and aligned with DMARC. These protocols verify that your messages are legitimate, improve inbox placement, and prevent bad actors from sending mail that appears to come from your domain.

Following the steps below (or watching the setup video) will ensure your domain meets current provider requirements and is eligible for reliable delivery.

The Benefits of Authenticated Sending

Setting up your domain authentication solves critical business problems:

• Higher Inbox Placement: Authenticated domains are recognized as trustworthy, significantly reducing the chance of your invoices or quotes being flagged as spam.

• Protected Brand Reputation: Authentication prevents bad actors from "spoofing" your email address, ensuring your customers only receive genuine messages from your business.

• Compliance with Industry Standards: Staying up to date with the latest security requirements from Google and Yahoo keeps your marketing and sales sequences running without interruption.

What are DKIM and DMARC?

To protect your business from being impersonated by hackers, the internet uses two primary security protocols. Think of these as a digital ID card and a set of instructions for what to do if that ID card is missing.

• DKIM (DomainKeys Identified Mail): DKIM is a technical standard that attaches a hidden digital signature to every email you send. When an email provider like Gmail or Outlook receives your message, they check this signature against your domain settings to verify that the email truly came from you and hasn't been tampered with while in transit. By using DKIM, you are telling the world that your business is the legitimate sender of the message, which prevents your emails from being flagged as "suspicious."
• DMARC (Domain-based Message Authentication, Reporting & Conformance): DMARC is a set of instructions you provide to email servers. It tells them exactly how to handle any email that claims to be from your business but fails the security checks (like DKIM). With a DMARC policy, you can instruct providers to either deliver the email anyway, move it to the spam folder, or reject it entirely. This gives you total control over your brand's reputation and ensures that fraudulent emails using your name never reach your customers.

How To Authenticate Your Domain in Keap

1. Access Email Authentication Settings

• Pro/Max Edition: Click on your profile picture in the bottom left corner, select Settings, and navigate to the Domains page.
  
  

From here, Thryv will guide you through the process of connecting your domain. For full instructions, see the article Authenticate Your Domain in Keap to Protect Email Deliverability

• Ultimate/Classic Edition: Click on the hamburger menu dropdown, select Marketing. Then click on  Settings, and click on Email Authentication.
  

2. Add Your Domain

Click on the + Connect Email Domain button. Then, enter your domain. Select your domain host from the dropdown list. If unsure of your domain host, use this tool.

• Verify Your DMARC Record
  1. Before creating a new DMARC record, it’s important to check if one already exists for your domain—you should only have one DMARC record.
  2. If you already have a DMARC record, leave the “Create or Update DMARC Record” checkbox unchecked.
  3. Not sure if you have a DMARC record? Use the free tool from Dmarcian: Just enter your domain and click “Inspect the Domain” to see if a DMARC record is already in place.
  4. You can also check directly by logging into your DNS provider and reviewing your DNS records for an existing DMARC entry
• Create Your DMARC Record:
  1. If you do not have a DMARC record, or you want Keap to generate one for you:
  2. Check the “Create or Update DMARC Record” box.
  3. Keap recommends the following settings:
     1. Policy: Quarantine
     2. Quarantine Percentage: 5%
  4. Enter an email address you have access to. This address will receive DMARC aggregate reports from providers to help you monitor for unauthorized use of your domain.
     
• Generate and Add DKIM & DMARC Records:
  1. For your DKIM records Keap will generate 3 CNAME records that will look like:
     1. appname.yourdomain.com
     2. appname1._domainkey.yourdomain.com
     3. appname2._domainkey.yourdomain.com
  2. Click on the record to copy it (do not highlight manually to avoid copying extra text).
  3. In your domain’s DNS settings, add these as CNAME records:
     1. Depending on your DNS provider, the fields for entering these keys may be labeled as "Host" and "Points to" or "Name" and "Value." Enter the keys in the provided order, from left to right, regardless of the labeling.
  4. For adding your DMARC record
     1. In your domain's DNS settings, add a TXT record for DMARC:
        1. Host: _dmarc.yourdomain.com
        2. Value: v=DMARC1; p=quarantine; pct=5; rua=mailto:your-email@yourdomain.com
           
• Domain Verification:
  1. Add all of the keys provided to your DNS provider
  2. Once all records are added to your DNS provider, click Finish in Keap.
  3. You’ll return to the Domains or Email Authentication page, where your domain status will show as Pending or Connected.
  4. It may take 24-48 hours for your domain to connect. If it remains pending for longer, verify your DNS entries using the DIG tool mentioned earlier.
• Start Sending From Your Authenticated Domain
  1. Once the domain you are wanting to send email from shows as “Connected”
  2. For Pro/Max navigate to the profile settings page by clicking on the profile icon button in the lower left corner and then click on the top selection to open profile settings
     
     
  3. Once you’ve update the email address to use a connected domain, click update
     
  4. For Classic to update the email associated with your profile, you will need to click on the profile icon, then edit my profile
     

Additional help/FAQs

DNS Guides:You'll need to create CNAME and TXT entries in your DNS records. If you're unsure how, contact your DNS provider for assistance, as steps may vary. Here are links to help articles for common DNS providers:

• GoDaddy
• Cloudflare
• BlueHost
• Host Gator
• DreamHost
• Liquid Web
• In-Motion
• Amazon CloudFront
• Google Cloud

Handling Domain Conflicts:

• If the CNAME keys are already in use, click on the "Conflict with your domain?" dropdown to enter a custom subdomain prefix.
• If your domain authentication is stuck in "Pending": If you previously had your domain authenticated within Keap and it is stuck in the Pending status for more than 48 hours, you will need to click on the edit button (pictured below) and go through the steps above, if you have already copied over the appropriate records just click confirm when you get to the records page. If your records have been verified it will move into Connected and if it is still verifying it will remain in the Pending status until verification is completed.

FAQ

When did Keap begin requiring DKIM verification to comply with these measures?

In response to email providers requiring DKIM verification, beginning in 2024 Keap implemented the requirement. The change was rolled out in phases to existing accounts and required for all new accounts going forward.

How long does it take for my domain to show as Connected? Once you add the records to your DNS provider and click Finish in your settings, it typically takes 24 to 48 hours for the changes to spread across the internet. During this time, your status may appear as Pending. If it remains pending for longer than two days, you should double check that the records in your DNS provider exactly match the keys provided in your account.

Can I authenticate more than one domain for my emails? Yes. If your business uses multiple web addresses to send emails, you should complete the authentication process for each one. This ensures that every message you send, regardless of the "From" address, is recognized as safe and professional by your customers' email providers.