How DKIM Works in UGMail
When UGMail sends an outbound message on behalf of your domain, it attaches a cryptographic signature in the email header. The receiving server fetches your DKIM public key from DNS, verifies the signature, and confirms the message is authentic. Without a valid DKIM record, messages are more likely to be flagged as spam or rejected. You do not need to enable or configure DKIM signing in the API — it is always active for domains registered in your account. Your only task is to publish the public key record in DNS.Retrieve Your DKIM Record
GET /api/dns/{domain}
Your domain’s DKIM public key is included in the response from the DNS Records endpoint alongside the MX and SPF records.
Example Request
Example Response
host equal to ugmail._domainkey. The value field contains the full TXT record content you need to add at your registrar.
Configure DKIM for Your Domain
1
Fetch the DKIM record
Call
GET /api/dns/{domain} with your domain name. Find the TXT record where host is ugmail._domainkey. Copy the full value string — it begins with v=DKIM1; k=rsa; p=....2
Create the DNS TXT record at your registrar
Log in to your DNS provider and create a new TXT record with the following values:
The full DNS name for this record will be
ugmail._domainkey.yourdomain.com. Most registrar interfaces accept just ugmail._domainkey as the host and append your domain automatically.3
Wait for DNS propagation
DNS changes propagate globally within minutes to hours. Allow up to 48 hours for full propagation before considering a record missing.
4
Verify the DKIM record is live
Use MXToolbox DKIM Lookup to confirm your record is publicly visible. Enter your domain and
ugmail as the selector. A passing result confirms DKIM is correctly configured.DKIM Record Reference
The DKIM TXT record published in DNS follows this structure:
The selector UGMail uses is
ugmail, so the full DNS record name is:
Why DKIM Matters
Enabling DKIM alongside SPF and DMARC forms a complete email authentication stack that significantly improves deliverability:- SPF confirms the sending server is authorized to send for your domain
- DKIM proves the message content has not been altered and was signed by your domain
- DMARC (configured at your registrar) tells receivers what to do when SPF or DKIM checks fail
DNS propagation can take up to 48 hours in rare cases, though most providers update within a few minutes. If MXToolbox does not find your record immediately after adding it, wait and check again. Do not add duplicate TXT records for the same host.