Perform DKIM authentication

AI-generated summary

Genesys Cloud implements DKIM authentication through Amazon SES to secure email communications and prevent outbound messages from being classified as spam. The system automatically generates 2048-bit DKIM keys that rotate annually, with one active DKIM signature maintained alongside backup signatures for error recovery. Implementation requires administrators to add three unique CNAME records containing domain-specific tokens to their organizational DNS settings through the Domain Verification page's Advanced Settings, accessible via the Digital and Telephony > Email menu. Required permissions include Routing > Email > Manage, Responses > Response > View, and Email > Settings > View. DKIM authentication generates digital signatures that verify message legitimacy and improve deliverability without modifying email content in transit. The system performs internal validation of all signatures and aligns with major mailbox providers' requirements (Google, Microsoft, Yahoo) while preparing for upcoming DMARC authentication enforcement. While email transmission is possible without DKIM, Genesys Cloud recommends enabling it to enhance email authentication and recipient trust. If DKIM setup is not completed or verification fails, Amazon SES continues to send emails but without DKIM signatures, potentially affecting authentication outcomes. Failed verification can be resolved by clicking Refresh to regenerate tokens. Supported licensing includes Genesys Cloud CX 2, CX 2 Digital, CX 3, CX 3 Digital, CX 4, or CX 1 Digital Add-on II. Additional features include ACD email routing, agentless notifications, custom domain usage, and MX record integration. The configuration is domain-specific and requires customization to match the organization's actual domain. The verification status transitions from "Pending Verification" to "Verified" upon successful implementation by both Genesys Cloud and Amazon SES, enabling outbound emails to be signed with DKIM signatures for enhanced security and deliverability.

Series: Use the organization email domain name

Previous suggested step: Add the MX record to the organization’s domain server

Next suggested step: Set up custom MAIL FROM configuration

PrerequisitesClick to expand

Optionally set up extra customization for sending and receiving email, including DKIM authentication. Configuring DKIM authentication helps prevent outbound email routed through your custom domain from being marked as spam.

Notes:

Genesys recommends that you enable DKIM to avoid potential delivery disruptions and to align with upcoming DMARC authentication enforcement. Major mailbox providers—including Google, Microsoft, and Yahoo—already require DKIM with SPF for trusted email delivery. Genesys Cloud checks for DMARC compliance and for authenticated outbound email for which DKIM configuration is mandatory.
DKIM is a type of email authentication that generates a signature for the outbound email. This signature shows senders that the message is legitimate and was not modified in transit. Having authenticated emails increases deliverability. For more information about DKIM authentication, see Authenticating your email in Amazon SES and DKIM frequently asked questions.
Amazon SES automatically adds a 2048-bit DKIM key to every email that you send from your domain. For more info see the AWS article, Easy DKIM in Amazon SES.
Amazon SES automatically rotates the DKIM domain keys every 365 days; however, the frequency of key rotation can vary without prior notice.
Genesys Cloud uses only one DKIM signature and retains the other DKIM signatures as backup in case the one in use encounters any errors.
Genesys Cloud validates all DKIM signatures internally. Genesys does not own any responsibility for validation results by any third-party tool.

When you create your domain, Genesys Cloud automatically generates DKIM records. You can set up DKIM anytime. To set up DKIM authentication, add the provided records to your domain’s Domain Name System (DNS). Each record contains a set of unique tokens retrieved for a domain through the SES. This information is unique for each domain.

Note: In the following example, Genesys Cloud replaces support.company.com with your domain name.

Name	Type	Value
UNIQUE_TOKEN_1._domainkey.support.company.com	CNAME	“UNIQUE_TOKEN_1.dkim.amazonses.com”
UNIQUE_TOKEN_2._domainkey.support.company.com	CNAME	“UNIQUE_TOKEN_2.dkim.amazonses.com”
UNIQUE_TOKEN_3._domainkey.support.company.com	CNAME	“UNIQUE_TOKEN_3.dkim.amazonses.com”

Note: This article includes the general process DNS providers typically use to add DKIM records to your domain’s Domain Name System. The procedure you use can differ, depending on your DNS service provider.

In Genesys Cloud, copy the DKIM records:
1. Click Menu > Digital and Telephony > Email.
2. Locate the organization’s email domain and click Edit. The Domain Verification page opens.
3. Click Show Advanced Settings.
4. Under DKIM Authentication, copy the DKIM records.
In your DNS provider’s website, sign in and navigate to the page for updating your domain’s DNS records.
Follow your provider’s instructions for adding DKIM records.
Note: When Genesys Cloud verifies the records, the Pending Verification message changes to Verified and outbound emails use DKIM.

When SES verifies the records, outbound emails use DKIM. If you do not set up DKIM, or if the process fails, Amazon SES still sends your email. However, the email is not signed using a DKIM signature.

Note: If verification fails, click Refresh toregenerate tokens.

[NEXT] Was this article helpful?

Get user feedback about articles.

Loading...

Perform DKIM authentication

Series: Use the organization email domain name

[NEXT] Was this article helpful?