How to publish DKIM for authenticated SMTP sending

Quick answer for publish dkim smtp

RFC 6376 DKIM attaches a cryptographic signature to selected headers and the body. The destination looks up the selector under _domainkey and verifies. If you send as hello@yourdomain.com through MailerZ, your zone must publish the public key MailerZ shows. If you only receive, you do not publish DKIM for every customer who emails you.

Two jobs get mixed. Inbound: exclusive MX, SRS envelope, Header From intact. Outbound: paid plan, approved From, SPF, DKIM, DMARC. Publishing DKIM on Friday does not fix leftover aspmx. Deleting leftover MX does not sign outbound mail.

Selectors matter. A leftover Google selector next to a MailerZ selector is fine if both keys still sign something you send. A leftover selector you no longer use is clutter, not a second MX. Do not create two MailerZ selectors because the first “looked short.” Copy the dashboard once. Wait DNS. Send a probe.

CNAME versus TXT: some panels want a CNAME to a provider key host. MailerZ tells you which shape to publish. Do not invent a second record type “just in case.” Two contradictory DKIM records for the same selector fail verification.

Authoritative mail transport is still IETF RFC 6376 — DomainKeys Identified Mail (DKIM). send and reply. docs. troubleshooting.

The real decision

Operators search this after Gmail Send mail as is accepted but the far side shows dkim=fail or unsigned. They paste a blog post key from 2019. They publish the key at the apex instead of selector._domainkey. They publish two TXT strings for the same selector. They stay on Free and wonder why SMTP 550 appears before DKIM ever runs.

Decision one: are you signing mail you send, or debugging a forward? Forwards keep the sender’s DKIM if MIME is intact. You do not replace that signature. Decision two: can you leave Free? Send-as is paid. Decision three: can you staff one selector and a lookup-safe SPF? DKIM does not remove the ten-lookup SPF cap.

Agencies should refuse tickets titled “add DKIM” without a received outbound copy. If the message never left MailerZ, the failure is auth or plan, not DNS. If history shows 550 5.7.1, the From is unauthorized. Publishing a prettier key will not authorize it.

Do not buy Workspace to publish DKIM for a forward. Workspace is a suite. It signs mail Google sends. It does not sign MailerZ SMTP unless Google is the outbound hop—which it is not on this product path.

When this path is enough

• You are on a paid plan and send as a named alias.
• Dashboard DKIM is copied to the authoritative zone, not a parked registrar panel.
• You can prove with a third-party received copy.
• SPF is one record and under ten lookups.

When this is the wrong ticket

• You only receive and reply as Gmail.
• You are still on Free.
• Outbound never authenticates (550) — fix identity first.
• You are trying to sign a vendor’s inbound message.

Technical mail flow

Composer or app submits SMTP with the approved From. MailerZ accepts only hosted, authorized identities. The message is signed with the domain’s DKIM key. Destination looks up selector._domainkey.yourdomain. Pass or fail is on that outbound hop.

Inbound is a different path. Sender to MailerZ MX. SRS on MAIL FROM. Header From unchanged. The vendor’s DKIM may still pass if nobody rewrote MIME. Your newly published selector is irrelevant to that hop.

DMARC alignment for outbound wants Header From aligned to the DKIM d= domain. Keep From as the approved alias. Do not send as a teammate’s personal Gmail domain through MailerZ. Unauthorized From is 550, not a DKIM miss.

DNS cutover order: aliases and verification first, exclusive MX, leftover delete, inbound probe, then paid SMTP plus SPF/DKIM/DMARC, then outbound probe. Reversing that order is how people “publish DKIM” on a domain that still delivers to Google.

Step-by-step decision path

1. Name the direction. Outbound send-as only. Capture a failed outbound received copy if you have one.
2. Leave Free. Send-as is unavailable on Free. Solo is the smallest paid send path.
3. Copy the dashboard selector. Publish exactly that name and key on the authoritative nameservers.
4. Keep one SPF TXT. Include MailerZ as instructed. Delete dead Google or ESP includes if you no longer send there.
5. Publish DMARC when ready. p=none is a report mode, not an inbox SLA.
6. Send a unique outbound probe to a mailbox you do not control. Read Authentication-Results.
7. Store the selector name in the same ticket as the MX screenshot so the next person does not invent a second key.

Worked examples

A founder published DKIM at @ instead of mailerz._domainkey. Destinations looked up the selector and found nothing. Moving the TXT to the selector name fixed verification. The inbound forward had never been broken.

An agency copied a CNAME and a TXT for the same selector. Some resolvers saw one, some the other. They deleted the extra. One record. Proof was a received dkim=pass, not the DNS UI.

A shop stayed on Free, published a key, and never got a signature. History showed 550. They upgraded to Solo, authorized hello@, and the same key started signing. DNS was waiting on a plan gate.

A WordPress plugin sent as wordpress@ via php mail(). DKIM on MailerZ never ran because the message never used MailerZ SMTP. They pointed the plugin at authenticated SMTP. Signatures appeared. Publishing a second selector would not have helped php mail().

A team left an old Google DKIM selector in place and added MailerZ. Outbound through MailerZ passed on the new selector. Google-signed leftovers were unused. Harmless clutter. They documented the live selector so nobody “cleaned up” the working one.

Failure modes and proof

MailerZ workflow and product boundary

Secuno LLC operates MailerZ. Site: mailerz.net. App: mail.mailerz.net. Envelope SRS only. Header From, Subject, Date, Message-ID, body, and MIME are never rewritten. Not IMAP. Not an open relay.

What MailerZ does

• Accept MX for verified domains.
• Rewrite envelope MAIL FROM with SRS on the forward.
• Leave Header From and MIME intact.
• Hold unknowns on Free. Optional paid FORWARD.
• Paid SMTP from approved identities. Dashboard SPF, DKIM, and DMARC instructions.
• 550 for unauthorized From. Not an open relay.

What MailerZ does not do

• Guarantee Gmail Primary or any inbox placement rate.
• Host IMAP, Calendar, or a Workspace suite.
• Send-as on Free.
• SOC 2, ISO 27001, HIPAA, review counts, or an uptime SLA. Controls: Security and Trust Center.

Plans: pricing. Free $0, 1 domain, 10 aliases, 1 seat, 14-day store, send-as disabled, SMTP and API disabled. Solo $40/year, 5 domains, 25 aliases, 90-day, 2,500 outgoing, 20/hour. Starter $8 or $80, 8/50/5, 5,000, 40/hour. Business $19 or $190, 25/200/25, 12,000, 60/hour. Agency $39 or $390, 100/500/50, 20,000, 60/hour. Unlimited is $99/month or $990/year. Annual Starter, Business, and Agency include two months free versus monthly. Solo is yearly only.

Cost, alternatives, and trade-offs

Field notes

Key rotation: when the dashboard rotates a selector, publish the new one before you retire the old, then prove, then delete. Overlapping selectors for a day is cheaper than a weekend of unsigned invoices.

2048-bit keys can wrap in DNS. If your panel splits the string badly, destinations fail. Paste as one TXT the way the dashboard shows. Do not hand-edit spaces into the p= value.

Subdomain sending: if WordPress sends as forms.yourdomain.com, the DKIM d= and the From domain must match your DMARC plan. Signing the apex while From is a subdomain is a common alignment miss.

SPF still matters. DKIM pass plus SPF permerror is a messy Authentication-Results line. Keep one SPF record. Count includes. ARC on inbound is a different article.

Gmail Send mail as confirmation messages travel inbound. If leftover MX exists, Google’s confirm may never hit MailerZ. Unmix MX before you debug DKIM on a From you cannot even confirm.

Hourly caps: Solo 20/hour, Starter 40, Business 60, Agency 60. A bursty form can 550 after DKIM is perfect. That is a plan ceiling, not a selector bug.

Do not put private keys in support tickets. The public p= value is fine. The SMTP password is not. Rotate if it leaked.

Proof packet: selector name, public TXT, outbound received Authentication-Results, plan name, From identity. That packet ends “just add a DKIM record at the apex” advice.

Related routes: send-as is /send-reply. DNS fights belong on /troubleshooting. Public lookups live under /tools. Features stay honest about what is not a mailbox.

Refresh when the dashboard publishes a new selector, you add an ESP, or you transfer the domain. Quarterly is a floor. A leftover Google include is still the usual SPF regression sitting next to a perfect DKIM key.

Search demand for publish dkim smtp usually arrives as a screenshot, not a sentence. Ask for the received copy, the public MX set, and the plan name before you change a record. How to Publish DKIM for Authenticated SMTP Sending is a workflow, not a checkbox.

Write a one-paragraph policy the team can reuse for publish dkim smtp. Name the hop (inbound versus outbound), the proof artifact, and the thing you will not do (dual MX, From rewrite, second SPF record). Put the paragraph in the ticket template.

Change control matters more than a clever record. One person owns DNS for this domain. Adding an include, a selector, or a backup MX requires a ticket. Most regressions in publish dkim smtp are Friday edits without a probe.

Self-send remains invalid for publish dkim smtp. Gmail can short-circuit. Outlook can look local. Use a mailbox on another provider and a unique subject. If the customer refuses, the ticket stays open.

Leftover MX masquerades as every authentication and spam incident. If history is empty, publish dkim smtp is the wrong title until two resolvers agree on one product. Delete aspmx, Microsoft, and registrar MX. Wait TTL.

Free HOLD and missing aliases masquerade as outages. History shows the hold. Create the named local-part or accept that unknowns stay. Catch-all FORWARD is paid, optional, and a spam trade-off — not a debugger for publish dkim smtp.

Paid send-as is a different hop from inbound publish dkim smtp. Free cannot send. Unauthorized From is 550 / 550 5.7.1. Publishing prettier DNS will not authorize a From the product has not approved.

Destination filters still win after a clean hop. How to Publish DKIM for Authenticated SMTP Sending does not include an inbox placement SLA, review counts, or a Primary guarantee. Say that once, early, so the customer stops buying a story you cannot ship.

Proof packet for publish dkim smtp: public MX from two resolvers, inbound received copy with Header From, Authentication-Results, outbound received copy if they send, plan name, and the SMTP line if anything refused. That packet ends folklore.

Retention is 14 days on Free and 90 on paid. Export headers while they live. publish dkim smtp arguments without artifacts become myths. The destination inbox is the archive, not the hop store.

Agencies should not blend clients in one publish dkim smtp thread. One domain, one matrix, one MX screenshot. Agency plan limits are 100 domains, 500 aliases, 50 seats, 20,000 outgoing, 60/hour — still not unlimited, still not an SLA.

Security hygiene: no SMTP passwords in the publish dkim smtp ticket, no message bodies in chat, no invented SOC 2. Controls live on the Security and Trust Center. Secrets rotate if they leaked.

Related operations stay on real routes: forwarding, send-as, troubleshooting, tools, delivery recovery, docs, pricing. Do not invent a pillar. If publish dkim smtp is actually leftover MX, say leftover MX.

Refresh cadence is at least quarterly, sooner after a domain transfer, panel change, ESP trial, or dashboard host change. How to Publish DKIM for Authenticated SMTP Sending goes stale when the zone changes and the runbook does not.

If two products still share MX after you explained the coin flip, stop adding records. Exclusive MX is a hard stop. publish dkim smtp cannot be correct on a split path.

If Header From is already rewritten, stop tuning SPF for publish dkim smtp. Change the hop. MailerZ will not offer a From-replace control. Honest identity is the product.

If the customer wants a suite, sell the suite as Calendar and a hosted mailbox, not as a magic fix for publish dkim smtp. Workspace and Microsoft 365 are different architectures with their own filters and their own 550s.

Hourly and monthly send-as ceilings (disabled/2,500/5,000/12,000/20,000 outgoing; 20/40/60/60 per hour by plan) produce refuses that look like publish dkim smtp outages. Read counters before you republish DKIM.

Null MX plus a real MX is another lie. Remove the lone-dot refuse if you intend to receive. Empty inbound plus a pretty publish dkim smtp essay is still a refuse-all.

After you change anything, wait TTL, probe from another mailbox, and store the new received source next to the MX screenshot. How to Publish DKIM for Authenticated SMTP Sending is done when proof exists, not when the panel is green.

Field story 1 for publish dkim smtp: A founder published DKIM at @ instead of mailerz._domainkey. Destinations looked up the selector and found nothing. Moving the TXT to the selector name fixed verification. The inbound forward had never been broken. Keep that story in the runbook so the next person does not reopen How to Publish DKIM for Authenticated SMTP Sending from zero.

Field story 2 for publish dkim smtp: An agency copied a CNAME and a TXT for the same selector. Some resolvers saw one, some the other. They deleted the extra. One record. Proof was a received dkim=pass, not the DNS UI. Keep that story in the runbook so the next person does not reopen How to Publish DKIM for Authenticated SMTP Sending from zero.

Field story 3 for publish dkim smtp: A shop stayed on Free, published a key, and never got a signature. History showed 550. They upgraded to Solo, authorized hello@, and the same key started signing. DNS was waiting on a plan gate. Keep that story in the runbook so the next person does not reopen How to Publish DKIM for Authenticated SMTP Sending from zero.

Field story 4 for publish dkim smtp: A WordPress plugin sent as wordpress@ via php mail(). DKIM on MailerZ never ran because the message never used MailerZ SMTP. They pointed the plugin at authenticated SMTP. Signatures appeared. Publishing a second selector would not have helped php mail(). Keep that story in the runbook so the next person does not reopen How to Publish DKIM for Authenticated SMTP Sending from zero.

Field story 5 for publish dkim smtp: A team left an old Google DKIM selector in place and added MailerZ. Outbound through MailerZ passed on the new selector. Google-signed leftovers were unused. Harmless clutter. They documented the live selector so nobody “cleaned up” the working one. Keep that story in the runbook so the next person does not reopen How to Publish DKIM for Authenticated SMTP Sending from zero.

For publish dkim smtp, symptom “dkim=none on outbound” usually means Key not visible or wrong selector. Isolate it with Public TXT at selector._domainkey. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “dkim=fail” usually means Body mutated after sign, or truncated key. Isolate it with Compare key and MIME. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “SMTP 550” usually means Free or unauthorized From. Isolate it with History. Not DNS first. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “Inbound missing” usually means Leftover MX. Isolate it with Two resolvers. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “Two DKIM records one selector” usually means Panel duplicate. Isolate it with TXT count. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “Self-send looks unsigned” usually means Gmail short-circuit. Isolate it with Other mailbox. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “php mail unsigned” usually means Not using MailerZ SMTP. Isolate it with Plugin host settings. Do not stack a second change until that proof exists.

For publish dkim smtp, symptom “Published on registrar, NS elsewhere” usually means Wrong panel. Isolate it with NS lookup. Do not stack a second change until that proof exists.

Setup step “Name the direction.” for publish dkim smtp: Outbound send-as only. Capture a failed outbound received copy if you have one. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Setup step “Leave Free.” for publish dkim smtp: Send-as is unavailable on Free. Solo is the smallest paid send path. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Setup step “Copy the dashboard selector.” for publish dkim smtp: Publish exactly that name and key on the authoritative nameservers. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Setup step “Keep one SPF TXT.” for publish dkim smtp: Include MailerZ as instructed. Delete dead Google or ESP includes if you no longer send there. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Setup step “Publish DMARC when ready.” for publish dkim smtp: p=none is a report mode, not an inbox SLA. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Setup step “Send a unique outbound probe” for publish dkim smtp: to a mailbox you do not control. Read Authentication-Results. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Setup step “Store the selector name” for publish dkim smtp: in the same ticket as the MX screenshot so the next person does not invent a second key. Skip it and How to Publish DKIM for Authenticated SMTP Sending turns into a second ticket next week. Do the step, store the artifact, then continue.

Trade-off on publish dkim smtp: choosing Dashboard DKIM + paid SMTP gets you Aligned outbound signatures and gives up You must stay under plan caps. Write that exchange on the quote so nobody pretends it is free.

Trade-off on publish dkim smtp: choosing Skip DKIM, send anyway gets you Faster Friday and gives up DMARC and filters suffer. Write that exchange on the quote so nobody pretends it is free.

Trade-off on publish dkim smtp: choosing Suite MX instead gets you Google or Microsoft signs and gives up Per-user price. Write that exchange on the quote so nobody pretends it is free.

Trade-off on publish dkim smtp: choosing php mail as the domain gets you No SMTP credentials and gives up Usually unsigned, often blocked. Write that exchange on the quote so nobody pretends it is free.

How to Publish DKIM for Authenticated SMTP Sending is enough when You are on a paid plan and send as a named alias. If that condition is false, stop implementing publish dkim smtp and reopen the decision.

How to Publish DKIM for Authenticated SMTP Sending is enough when Dashboard DKIM is copied to the authoritative zone, not a parked registrar panel. If that condition is false, stop implementing publish dkim smtp and reopen the decision.

How to Publish DKIM for Authenticated SMTP Sending is enough when You can prove with a third-party received copy. If that condition is false, stop implementing publish dkim smtp and reopen the decision.

How to Publish DKIM for Authenticated SMTP Sending is enough when SPF is one record and under ten lookups. If that condition is false, stop implementing publish dkim smtp and reopen the decision.

How to Publish DKIM for Authenticated SMTP Sending is the wrong ticket when You only receive and reply as Gmail. Name the correct system instead of forcing publish dkim smtp to cover it.

How to Publish DKIM for Authenticated SMTP Sending is the wrong ticket when You are still on Free. Name the correct system instead of forcing publish dkim smtp to cover it.

How to Publish DKIM for Authenticated SMTP Sending is the wrong ticket when Outbound never authenticates (550) — fix identity first. Name the correct system instead of forcing publish dkim smtp to cover it.

How to Publish DKIM for Authenticated SMTP Sending is the wrong ticket when You are trying to sign a vendor’s inbound message. Name the correct system instead of forcing publish dkim smtp to cover it.

FAQ

Key takeaways

• DKIM signs mail you send. It is not inbound MX.
• Copy the dashboard selector. One record. Authoritative NS.
• Free has no send-as. 550 is not a missing key.
• Do not sign a vendor’s inbound message.
• Prove with a third-party received copy.
• One SPF TXT still matters beside DKIM.
• php mail bypasses the signer.
• Wrong panel (registrar vs NS) looks like a missing key.
• Caps can 550 after signatures are correct.
• MailerZ is not IMAP and not SOC 2.

Conclusion and next action

If you came here to publish DKIM for authenticated SMTP sending, the job is outbound. Leave Free, copy the selector, keep one SPF record, and prove with a received copy. Do not use DKIM to paper over leftover MX.

Next action: confirm the plan allows send-as, publish the dashboard key on the nameservers that actually answer, send a unique message to a mailbox you do not own, and read dkim= on that copy.

Review quarterly, or sooner if DNS hosts or dashboard instructions change. Author: MailerZ editorial, Secuno LLC.