Documentation menu

DKIM & Domain Authentication FAQ

Frequently asked questions about authenticating your sending domain in PostBeagle.

General Questions

How does PostBeagle authenticate my email?

PostBeagle sends your email from its own infrastructure (a self-hosted Postfix/Rspamd stack) and signs it with DKIM using a key that is unique to your domain. You publish three DNS records on your own domain:

  • DKIM (required) — a single TXT record that holds your domain's public key
  • SPF (recommended) — authorizes PostBeagle's servers to send for your domain
  • DMARC (recommended) — tells receivers how to handle messages that fail authentication

There is no proxy or "white-label" DNS layer — the records live directly on your domain.

Who generates and holds my DKIM key?

PostBeagle does. When you add a domain, PostBeagle generates an RSA key pair for it. The public key goes into the DKIM TXT record you publish; the private key is stored encrypted by PostBeagle and deployed to the signing infrastructure once your domain verifies. You never have to handle the private key.

Do I need to change my existing DNS records?

Only to add the PostBeagle records. Your existing records (e.g. an SPF record for Google Workspace, your MX records) are untouched — except that if you already have an SPF record you merge PostBeagle's include into it rather than adding a second SPF record (see below).

Setup Questions

How many DNS records do I need to add?

Required:

  • 1 DKIM TXT record

Recommended:

  • 1 SPF TXT record
  • 1 DMARC TXT record

So 1–3 records in total. (There is only one DKIM record — selector s1. Earlier versions of PostBeagle used three CNAME records; that approach has been retired.)

What do the records look like?

# DKIM (required)
Name:  s1._domainkey.yourdomain.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0...   (the exact key is shown in PostBeagle)

# SPF (recommended)
Name:  yourdomain.com   (root / "@")
Type:  TXT
Value: v=spf1 include:spf.postbeagle.com ~all

# DMARC (recommended)
Name:  _dmarc.yourdomain.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Always copy the exact DKIM value from your PostBeagle dashboard — the public key is unique to your domain.

What if I already have an SPF record?

You may only have one SPF record per domain, so merge PostBeagle's include into your existing record:

# Existing
v=spf1 include:_spf.google.com ~all

# Updated (add PostBeagle)
v=spf1 include:_spf.google.com include:spf.postbeagle.com ~all

What is spf.postbeagle.com?

It's the SPF include that points to PostBeagle's sending infrastructure. Referencing it in your SPF record authorizes PostBeagle's mail servers to send on behalf of your domain. This is the standard SPF include: pattern used by every major email platform.

Can I use a subdomain?

Yes. Send from a subdomain (e.g. mail.yourdomain.com) by adding it as its own domain in PostBeagle and publishing the records for that subdomain. Each domain or subdomain has its own DKIM key and its own set of records.

Do I need records for each email address?

No. DNS records are per domain, not per address. One set of records covers [email protected], [email protected], and every other address on the domain.

Verification Questions

How does verification work?

After you publish the records, PostBeagle checks them by DNS lookup:

  1. It resolves s1._domainkey.yourdomain.com and confirms the TXT record contains your domain's public key.
  2. It resolves your domain's TXT records and confirms one contains include:spf.postbeagle.com.

When both pass, your domain is marked verified and your DKIM key is automatically deployed to the signing infrastructure. DMARC is recommended but not required to verify.

How long does verification take?

DNS propagation usually takes 1–2 hours (up to 24 in rare cases). Once the records are visible, clicking Check Verification in PostBeagle is instant.

Why is my domain still pending after 24 hours?

Common causes:

  1. The records weren't saved, or were saved with the wrong type (must be TXT).
  2. The record name is wrong (must be exactly s1._domainkey.yourdomain.com).
  3. The DKIM value was truncated or altered when pasting.
  4. A duplicate/conflicting record exists at the same name.

See the DKIM Troubleshooting Guide.

How do I check the records myself?

# DKIM
dig s1._domainkey.yourdomain.com TXT

# SPF
dig yourdomain.com TXT | grep spf1

# DMARC
dig _dmarc.yourdomain.com TXT

Can I send email before verifying?

No. You must verify a domain before sending from it. Verification proves you own the domain and enables authentication, which protects deliverability.

Maintenance Questions

Does my DKIM key expire or need periodic "refreshing"?

No. Your DKIM key does not expire and there is no periodic refresh to perform. Once your records are published and the domain is verified, they keep working — leave them in place.

What if my DKIM key ever needs to be re-issued?

Because the public key lives directly in your TXT record, re-issuing a key means the TXT value changes and you update that one record. This is rare and PostBeagle will tell you if it's ever needed; there is no self-service key-rotation feature today.

What if I accidentally delete the records?

Open Settings → Domains, select your domain, and re-copy the records from the DNS instructions. Re-add them, wait for propagation, and verify again. The values are always available in PostBeagle.

Troubleshooting Questions

How do I test that signing works?

Send yourself a test message and inspect the headers. You should see a DKIM-Signature with d=yourdomain.com; s=s1, and Authentication-Results: dkim=pass. Tools like mail-tester.com and dkimvalidator.com report the same thing.

A note on Cloudflare

TXT records can't be proxied, so the "orange cloud" setting doesn't apply to any of the PostBeagle records — just add them as normal DNS records.

Who do I contact for help?

Email [email protected] with your domain name, your DNS provider, and the exact error shown in PostBeagle. Typical response time is within 24 hours.

Additional Resources