Setting Up DKIM on DirectAdmin Step by Step

DKIM (DomainKeys Identified Mail) is one of the most critical tools for ensuring your emails reach the inbox. If you've set up only SPF and left DKIM unconfigured, your emails are at high risk of landing in spam regardless of how perfectly your SPF is configured. On AsiaGB Hosting, setting up DKIM is simple — just enable one toggle in DirectAdmin and you're done. This guide will walk you through each step in detail.

What is DKIM and Why Does It Matter?

DKIM is a digital signature for emails. The way it works: DKIM uses a Private Key to sign every outgoing email, and publishes a corresponding Public Key in DNS. When a recipient's mail server (Gmail, Yahoo, etc.) receives your email, it uses the Public Key to verify that the email truly came from your server and that the content hasn't been tampered with during transmission.

In simple terms, if you only have SPF without DKIM, an attacker could still spoof your domain by faking the From address to look like it came from an authorized server, but the email body could be anything malicious. DKIM stops this type of attack because it cryptographically verifies that the email body was actually signed by your server's private key.

How DKIM, SPF, and DMARC Work Together

When talking about email authentication, people often say \"SPF, DKIM, DMARC\" in sequence, but these are actually three distinct technologies with different roles:

• SPF (Sender Policy Framework): Specifies which IP addresses are authorized to send mail on behalf of your domain. If the sending IP isn't in your SPF record, the receiving server will reject or spam the email.
• DKIM (DomainKeys Identified Mail): Cryptographically signs your email to prove the content hasn't been altered and came from your legitimate server.
• DMARC (Domain-based Message Authentication): A top-level policy that tells mail providers what to do with emails that fail SPF or DKIM checks, and requests reports about spoofing attempts on your domain.

All three work together. SPF and DKIM are the \"proofs,\" while DMARC is the \"policy.\" Together, they create a comprehensive authentication framework that email providers trust.

Preparing Before You Set Up DKIM

Before you enter DirectAdmin, make sure you have this information ready:

• Domain Name: The domain you want to set up DKIM for (e.g., example.com or company.co.th) — this should be the domain your emails are sent from.
• Email Account: You'll be setting up DKIM for the entire domain, not individual accounts. The primary email should be something like [email protected].
• Selector: DirectAdmin typically uses \"default\" or \"mail\" as the selector, but you can customize this if needed.

Step 1: Log Into DirectAdmin Control Panel

First, log into your DirectAdmin control panel:

• Navigate to your DirectAdmin URL (usually https://yourdomain.com:2222 or https://your-ip:2222)
• Enter your username (usually \"admin\" or your account username) and password
• Click \"Login\"

Once inside DirectAdmin, locate the \"Email Management\" or \"Mail\" section in the main menu. This is typically found in the left sidebar.

Step 2: Select Your Domain and Open Email Manager

Click on \"Email Management\" or \"Mail Manager.\" DirectAdmin will display all domains hosted on your account.

• Find the domain you want to set up DKIM for (e.g., example.com)
• Click on that domain name

DirectAdmin will now show the Email Manager for that specific domain. You'll see sections for email accounts and, most importantly, a toggle or button for \"DKIM\" or \"Enable DKIM.\"

Step 3: Enable DKIM

Look for the toggle or checkbox labeled \"Enable DKIM\" or a button that says \"Create DKIM.\" You'll have two options:

• If there's a Toggle: Click to enable it, and DirectAdmin will automatically generate the DKIM key.
• If there's a \"Create DKIM\" Button: Click it and DirectAdmin will generate both private and public keys for you.

After clicking, DirectAdmin will display your Public Key. Don't leave this page yet — you'll need the Public Key content in the next step.

Step 4: Copy the DKIM Public Key and Create a DNS Record

DirectAdmin will show your DKIM Public Key in a format like this:

v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Copy the entire Public Key (starting from \"v=DKIM1\" through the end) and create a TXT DNS record with this information:

• Record Name: default._domainkey.example.com (replace \"default\" with your selector and \"example.com\" with your domain)
• Record Type: TXT
• Record Value: v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3... (the full value from Step 3)

If your domain uses DNS managed through DirectAdmin itself, go to DNS Management within DirectAdmin and add the record there. If your domain uses external DNS (Cloudflare, Google Domains, etc.), log into that provider's control panel and add the record with the same information.

Step 5: Wait for DNS Propagation and Verify

After adding the DKIM DNS record, you need to wait for it to propagate globally — typically 24-48 hours, though most of the time it's just 2-4 hours. You can check propagation status using MXToolbox or other DNS propagation checkers:

• Go to MXToolbox.com
• Select \"DKIM Lookup\"
• Enter \"default._domainkey.example.com\" (replace with your actual domain)
• Click \"MX Lookup\" — MXToolbox will tell you if the DKIM record is correct

Step 6: Test DKIM With Mail-Tester

After confirming the DKIM record in MXToolbox, perform a real-world test to ensure DKIM signature verification passes:

• Visit Mail-Tester.com
• Mail-Tester will provide a temporary email address (usually [email protected])
• Send a test email from your domain's email account to that address
• Return to Mail-Tester and click \"Then Check Your Score\"
• Mail-Tester will score your email out of 10 and report whether DKIM passed

If DKIM passes, you'll see \"DKIM: PASS\" in the report. If it fails, Mail-Tester will explain why — typically either the DNS record hasn't fully propagated yet or there's an issue with the key format.

Complete Your Authentication Setup With SPF and DMARC

DKIM alone isn't enough. You must also configure SPF and DMARC for maximum email deliverability. On AsiaGB, setting up SPF is straightforward:

SPF Record

Add a basic SPF record to your DNS:

v=spf1 a mx ~all

If you use external services to send emails (like Mailchimp or Google Workspace), add their include directives:

v=spf1 a mx include:sendgrid.net ~all

DMARC Record

Add a basic DMARC record:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

This record tells mail providers to quarantine emails that fail SPF/DKIM and to send daily reports to [email protected].

Additional Tips for Better Email Deliverability

• Remove Hard Bounces: Emails to addresses that don't exist should be removed immediately. Soft bounces (temporary failures) can be retried, but hard bounces must be deleted.
• Keep Complaint Rate Low: Maintain a complaint rate below 0.1%. Make unsubscribe buttons prominent and functional, and only send to opted-in recipients.
• Avoid Spam Traps: Never send to test addresses, outdated email lists, or addresses you haven't interacted with recently.
• Monitor IP Reputation: Use MXToolbox to check if your IP is blacklisted. If it is, contact your hosting provider's support team immediately.

Common Problems and Solutions

Problem: DKIM record still hasn't updated even after 24+ hours

Solution: Check DNS propagation status using MXToolbox or whatsmydns.net. If propagation is incomplete, wait 24 more hours. If it's still not complete after 48 hours, contact Support.

Problem: Mail-Tester says DKIM Failed

Solution: Verify that your DKIM Public Key is correct. The p= value should be roughly 380–420 characters for a 2048-bit key. If it's significantly shorter, you may have missed characters when copying. If you're confident it's correct, wait 24 hours for DNS to fully propagate, then test again.

Problem: Emails still landing in spam even though DKIM passes

Solution: DKIM alone isn't sufficient — you must also configure SPF and DMARC. Additionally, check your IP reputation, domain reputation, complaint rate, and bounce rate using email analytics tools.