# Email DNS settings: DKIM published is not the same as active

3 November 2026

For years, my domain's email signing was misconfigured. One setting had never been switched on.

Receivers check 3 DNS (Domain Name System) records to decide whether mail that claims to be from you really is:

- SPF (Sender Policy Framework): which servers may send mail for your domain.[^spf]
- DKIM (DomainKeys Identified Mail): a signature on your mail, made for a domain. Your mail provider signs with the private half of a key, and the public half sits in that domain's DNS.[^dkim]
- DMARC (Domain-Based Message Authentication, Reporting, and Conformance): what receivers should do with mail that fails both checks for your domain, and where to send reports. Its policy has 3 levels: none, quarantine (treat as suspicious, usually by sending to spam[^google-dmarc]) and reject (refuse).[^dmarc]

My DMARC was at none, so mail that failed the checks could still be delivered. Now and then a bounce (a "could not deliver" notice) arrived for mail I never sent: someone was sending as my domain. I wanted to move DMARC to reject.

But reject is only safe when DKIM works. Forwarding usually breaks SPF but leaves DKIM intact,[^indirect] so mail relying on SPF alone fails DMARC when forwarded and can be refused at reject. The DMARC standard says it outright: a domain at reject must not rely on SPF alone.[^dmarc-reject]

My DKIM key was published, exactly where it should be.

In the Google Workspace Admin console, under Gmail > Authenticate email, there's a button labelled "Start authentication", and I had never clicked it.[^google-dkim] Until you click it, Google keeps signing your mail with its own fallback key,[^google-dkim-2024] on a domain like the one my mail carried: `yprez-com.20221208.gappssmtp.com`. Google's DKIM setup page doesn't mention the fallback.[^google-dkim] An older version of it did.[^google-dkim-2024]

The signature was valid, but for the wrong domain. By default, DMARC only credits a signature from your own domain or one of its subdomains.[^dmarc-alignment] My mail was getting by on SPF alone.

The fix was to click "Start authentication". With DKIM signing as my domain, I could move DMARC to reject. The bounces for mail I never sent stopped.

[![Before: mail from y@yprez.com is signed with Google's fallback key, as yprez-com.20221208.gappssmtp.com. DMARC sees the wrong domain, so only SPF counts, and my key in DNS is never used. After "Start authentication": signed with my key, as yprez.com, which matches the From domain, so DKIM counts too.](https://yprez.com/images/blog/email-dns-dkim-figure.png)](https://yprez.com/images/blog/email-dns-dkim-figure.png)

## How to check your domain

To check your domain, send a message from it to a personal Gmail account. Open it in Gmail on the web, choose "Show original"[^gmail] and read the DKIM line. If it doesn't say "PASS" with your domain, your DKIM isn't working.

A DKIM line that names a domain ending in gappssmtp.com means Google is signing with its fallback key, not yours.

I've been adding email DNS checks to [Code Quality Check](https://codequalitycheck.com), the scanner we build. It checks SPF and DMARC configuration and flags weaknesses in email spoofing protection. Spotting the DKIM fallback takes a real message, since no DNS lookup can see which key actually signs.

What else would you check before setting DMARC to reject? If you want a second pair of eyes on your domain, send me a message.

[^spf]: [RFC 7208, Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208)
[^dkim]: [RFC 6376, DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376)
[^google-dmarc]: [Google Workspace Admin Help, Set up DMARC](https://knowledge.workspace.google.com/admin/security/set-up-dmarc)
[^dmarc]: [RFC 9989 (DMARC), section 4.7, DMARC Policy Record Format](https://www.rfc-editor.org/rfc/rfc9989#section-4.7)
[^indirect]: [RFC 7960, Interoperability Issues between DMARC and Indirect Email Flows](https://www.rfc-editor.org/rfc/rfc7960)
[^dmarc-reject]: [RFC 9989 (DMARC), section 7.4, Interoperability Considerations](https://www.rfc-editor.org/rfc/rfc9989#section-7.4)
[^google-dkim]: [Google Workspace Admin Help, Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim)
[^google-dkim-2024]: [Google Workspace Admin Help, Turn on DKIM for your domain (archived, January 2024)](https://web.archive.org/web/20240123085129/https://support.google.com/a/answer/180504?hl=en)
[^dmarc-alignment]: [RFC 9989 (DMARC), section 3.2.10.1, Relaxed Alignment](https://www.rfc-editor.org/rfc/rfc9989#section-3.2.10.1)
[^gmail]: [Gmail Help, Trace an email with its full header](https://support.google.com/mail/answer/29436)