> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mail.ugmail.co/llms.txt
> Use this file to discover all available pages before exploring further.

# DKIM Configuration API — Enable Email Signing per Domain

> Configure DKIM signing for your UGMail domains. Retrieve your DKIM public key from the DNS endpoint and add it as a TXT record at your registrar.

DKIM (DomainKeys Identified Mail) is a cryptographic email authentication standard that lets receiving mail servers verify that messages were genuinely sent by your domain and were not tampered with in transit. UGMail automatically signs outgoing messages with your domain's private key — you just need to publish the corresponding public key as a DNS TXT record at your registrar.

DKIM signing is enabled per domain. The public key for each domain is generated when you register the domain with UGMail and is available immediately via the DNS Records API.

***

## How DKIM Works in UGMail

When UGMail sends an outbound message on behalf of your domain, it attaches a cryptographic signature in the email header. The receiving server fetches your DKIM public key from DNS, verifies the signature, and confirms the message is authentic. Without a valid DKIM record, messages are more likely to be flagged as spam or rejected.

You do not need to enable or configure DKIM signing in the API — it is always active for domains registered in your account. Your only task is to publish the public key record in DNS.

***

## Retrieve Your DKIM Record

<br />

`GET /api/dns/{domain}`

Your domain's DKIM public key is included in the response from the DNS Records endpoint alongside the MX and SPF records.

### Example Request

```bash theme={null}
curl "https://mail.ugmail.co/api/dns/example.com" \
  -H "Authorization: Bearer YOUR_TOKEN"
```

### Example Response

```json theme={null}
{
  "mx": [
    { "host": "@", "value": "mail.ugmail.co", "priority": 10 }
  ],
  "txt": [
    { "host": "@", "value": "v=spf1 include:ugmail.co ~all" },
    { "host": "ugmail._domainkey", "value": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..." }
  ]
}
```

The DKIM record is the TXT entry with `host` equal to `ugmail._domainkey`. The `value` field contains the full TXT record content you need to add at your registrar.

***

## Configure DKIM for Your Domain

<Steps>
  <Step title="Fetch the DKIM record">
    Call `GET /api/dns/{domain}` with your domain name. Find the TXT record where `host` is `ugmail._domainkey`. Copy the full `value` string — it begins with `v=DKIM1; k=rsa; p=...`.

    ```bash theme={null}
    curl "https://mail.ugmail.co/api/dns/example.com" \
      -H "Authorization: Bearer YOUR_TOKEN"
    ```
  </Step>

  <Step title="Create the DNS TXT record at your registrar">
    Log in to your DNS provider and create a new TXT record with the following values:

    | Field           | Value                                                |
    | --------------- | ---------------------------------------------------- |
    | **Host / Name** | `ugmail._domainkey`                                  |
    | **Type**        | `TXT`                                                |
    | **Value**       | The full `v=DKIM1; k=rsa; p=...` string from the API |
    | **TTL**         | `3600` (or your provider's default)                  |

    The full DNS name for this record will be `ugmail._domainkey.yourdomain.com`. Most registrar interfaces accept just `ugmail._domainkey` as the host and append your domain automatically.
  </Step>

  <Step title="Wait for DNS propagation">
    DNS changes propagate globally within minutes to hours. Allow up to 48 hours for full propagation before considering a record missing.
  </Step>

  <Step title="Verify the DKIM record is live">
    Use [MXToolbox DKIM Lookup](https://mxtoolbox.com/dkim.aspx) to confirm your record is publicly visible. Enter your domain and `ugmail` as the selector. A passing result confirms DKIM is correctly configured.
  </Step>
</Steps>

***

## DKIM Record Reference

The DKIM TXT record published in DNS follows this structure:

```
v=DKIM1; k=rsa; p=<public-key>
```

| Tag       | Meaning                           |
| --------- | --------------------------------- |
| `v=DKIM1` | DKIM version — always `DKIM1`     |
| `k=rsa`   | Key type — RSA                    |
| `p=...`   | The base64-encoded RSA public key |

The selector UGMail uses is `ugmail`, so the full DNS record name is:

```
ugmail._domainkey.yourdomain.com
```

***

## Why DKIM Matters

Enabling DKIM alongside SPF and DMARC forms a complete email authentication stack that significantly improves deliverability:

* **SPF** confirms the sending server is authorized to send for your domain
* **DKIM** proves the message content has not been altered and was signed by your domain
* **DMARC** (configured at your registrar) tells receivers what to do when SPF or DKIM checks fail

<Note>
  DNS propagation can take up to 48 hours in rare cases, though most providers update within a few minutes. If MXToolbox does not find your record immediately after adding it, wait and check again. Do not add duplicate TXT records for the same host.
</Note>

<Tip>
  Once DKIM is verified, send a test message to [mail-tester.com](https://www.mail-tester.com) to get a full deliverability score for your domain configuration.
</Tip>