DKIM

Why RubySig signs your mail

A message that has been altered in transit fails any DKIM signature that was put on it before the alteration. Since RubySig appends a signature to the body, it must be the last party to sign — and it signs as your domain, with a key held for your organization, so the signature aligns with the From: address and satisfies DMARC.

Your platform's own DKIM (Microsoft's selector1/selector2, Google's google selector) stays as it is. RubySig uses its own selector so the two never collide.

The record

Publish one TXT record for each domain you send from through RubySig:

The full value — the public key is long — is on the portal's Setup page for your organization, with a copy button. At most DNS providers you enter the name as rubysig1._domainkey and the provider appends your domain.

Tip: Some providers split long TXT values into 255-character chunks automatically; others need you to paste it as one string. Either is fine — resolvers join the chunks. What breaks the record is a provider that truncates rather than splits, so after saving, check the length of what was actually published.

Checking it

From any machine:

dig +short TXT rubysig1._domainkey.example.com

You should see the v=DKIM1 value back. The portal's Setup page runs the same check and shows Published once RubySig can see the record; it re-checks on a timer, so a freshly added record turns green within a few minutes of resolving.

Until the record resolves, RubySig still stamps mail but does not sign it — it would be signing with a key nobody can verify. The relay logs this loudly; you will see it as dkim=none in received headers rather than as a bounce. Mail still delivers on the strength of your platform's own SPF alignment, but any domain publishing a strict DMARC policy should treat the record as part of setup, not an afterthought.

Multiple domains

Each sending domain gets its own key and its own record. The Setup page lists every domain RubySig knows for your organization and the status of each.

Rotation

RubySig rotates signing keys on its own schedule and will announce a new selector before any cut-over, with time to publish the new record alongside the old one. There is no action to take until then.