Kayako SPF and DKIM setup

What you are setting up

Kayako is a helpdesk. Every agent reply and every ticket notification leaves through Kayako's servers, and if your support address is on your own domain (support@yourdomain.com rather than support@yourcompany.kayako.com), those messages are sent as you. You authorize that by adding one SPF include and publishing three CNAME records that delegate DKIM to Kayako, then flipping a checkbox in the admin area. If you only use the default yourcompany.kayako.com address, there is nothing to publish: Kayako says the checkbox alone enables DKIM for its own domain.

Publish SPF and DKIM

Kayako's docs give the SPF record as v=spf1 mx include:email1.kayako.com ~all. If you already have an SPF record, add the include to it rather than creating a second one, and keep the mx mechanism only if your mail exchangers really do send outbound mail for you. Then add the three CNAME records for DKIM:

Type:  TXT     (SPF, merge into your existing record)
Host:  @
Value: v=spf1 include:email1.kayako.com ~all

Type:  CNAME
Host:  email
Value: email.kayako.com

Type:  CNAME
Host:  s1._domainkey
Value: s1._domainkey.kayako.com

Type:  CNAME
Host:  s2._domainkey
Value: s2._domainkey.kayako.com

Kayako lists all three CNAMEs as the DKIM setup, so publish all three; the two _domainkey hosts are the selectors Kayako signs with, and because they are CNAMEs Kayako can rotate keys on its side without you touching DNS again. Enter only the host portion if your DNS provider appends the domain for you, and do not paste Kayako's [YOURDOMAINNAME].com placeholder literally.

Now wait. Kayako's guidance is to give the records up to 24 hours to propagate before enabling DKIM. Then sign in to Kayako, go to the admin area, click Email under Channels, open the Settings tab, check Use DKIM to authenticate, and click Save.

Add DMARC

Standard _dmarc TXT record, nothing Kayako-specific. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once the reports show Kayako passing.

The Kayako gotcha

Ticking the DKIM box before DNS is live. Kayako warns that if you enable Use DKIM to authenticate before the CNAMEs have propagated, your emails may not send correctly. That is not a soft failure you can ignore for a day: it is your support replies. Publish the records, confirm the two _domainkey names resolve to Kayako's, and only then flip the checkbox. The related trap is that Kayako's docs describe no verification step, just the checkbox, so a typo in a CNAME target stays silent until replies start failing DKIM. Check the records yourself with our DKIM checker before you save.

Confirm it worked

• Resolve the CNAMEs. s1._domainkey.yourdomain.com and s2._domainkey.yourdomain.com should both return Kayako's DKIM keys through the CNAME, and email.yourdomain.com should point at email.kayako.com.
• Send a test and read the headers. Reply to a ticket from Kayako, open the message, and confirm the DKIM signature shows d=yourdomain.com with an s1 or s2 selector, and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Kayako should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.