Deliverability

To get started sending emails with Lime Marketing, you will need to set up these deliverability settings in order to use your organization's sending domains. Incorrect settings can lead to emails being rejected or marked as spam.

Verify domain ownership

Before you can start using the domain as a sending domain you need to verify ownership by adding a verification TXT record to the DNS. The verification record is added to the root domain and you only need to add it once. When the domain is verified you can remove the verification record.

DKIM

With DKIM (DomainKeys Identified Mail), Lime Marketing creates a digital signature based on the "From" information in the email with a private key. When a signed email from company.com is received, the signature is verified with the public key from company.com DNS.

Key sizes

DKIM signatures are made with an RSA key. Lime Marketing uses two key sizes, and which one a sending domain uses is decided when the domain is added:

Key size	Selector	DNS record you publish
2048-bit	bedrock2048	bedrock2048._domainkey.<your-domain> CNAME dkim2048.bedrock.lime-technologies.com
1024-bit	bedrock	bedrock._domainkey.<your-domain> CNAME dkim.bedrock.lime-technologies.com

Both are valid, and email signed with either passes DKIM at receiving mail servers. The industry has gradually moved towards 2048-bit as the recommended size, and major mailbox providers now suggest it, so that is what Lime Marketing uses for new sending domains.

Sending domains added from now on use the 2048-bit key automatically — there is nothing extra to do, just publish the DNS record shown in the sending domain settings.

Sending domains added earlier continue to use the 1024-bit key, and keep working exactly as before. There is no need to act, and Lime Marketing does not change them on its own. This is deliberate: an email is signed when it is sent but verified later, when it arrives — sometimes minutes or hours later, and longer still when mail is forwarded. If the key were swapped underneath a domain, messages still in transit would have been signed with the old key while DNS had already moved to the new one, and those messages would fail DKIM. Moving to 2048-bit is therefore something you choose to do, at a moment that suits you.

Check which key size a domain uses

Open the sending domain under Settings → Sending domains in Lime Marketing. The authentication settings show the domain's DKIM selector and Key size directly, so no external lookup tool is needed.

If the key size shows as Unknown, or the page reports that no DKIM certificate is configured for the domain, contact support before sending from it.

The same page also reports whether the DNS record you published has validated. A DNS lookup is only useful for confirming what is live in DNS right now — for example while waiting for a change to propagate:

nslookup -type=CNAME bedrock2048._domainkey.<your-sending-domain>

Move a sending domain to the 2048-bit key

This is optional. A sending domain on the 1024-bit key keeps working, and Lime Marketing does not change it on its own.

The domain is moved by changing its DKIM selector and certificate in place. The domain is never removed, so it can send throughout, and the Key size on the settings page confirms the change once it is saved.

Publish the new DNS record ahead of time

The bedrock2048._domainkey record is a CNAME pointing at a Lime-hosted target, so it can be created days or weeks before the sending domain is changed. It has no effect until the domain actually uses the bedrock2048 selector, and publishing it in advance means the switch itself takes effect immediately instead of waiting for DNS to propagate. If DNS changes go through a separate team or an external provider, this is the part worth requesting early.

1. Publish the bedrock2048._domainkey CNAME record for the domain:

   bedrock2048._domainkey.<your-domain>  CNAME  dkim2048.bedrock.lime-technologies.com
   

   This can be done well in advance, and changes nothing while the domain still uses the bedrock selector.

2. Confirm the record resolves, using the lookup above. The sending domain page cannot confirm it yet — it validates the record for the selector the domain currently uses, which is still bedrock.

3. A superuser sets the DKIM selector to bedrock2048 and the DKIM certificate to default_2048 on the sending domain settings page, then saves. If you do not have superuser access, contact support to make this change. Emails sent from now on are signed with the 2048-bit key.
4. Leave the old bedrock._domainkey record published.

Do not remove the old DKIM record immediately

Emails sent before the change are signed with the old key and may not be verified by the receiving server until hours later. Keep the old bedrock._domainkey record published for at least a few days afterwards so that mail still in transit continues to pass DKIM. After that it can be removed.

If the domain has to be removed and re-added instead

Removing a sending domain and adding it again also picks up the current defaults, and therefore the 2048-bit key. Prefer changing the selector and certificate in place — this route interrupts sending and is only needed if the settings cannot be changed:

1. Note the sending domain's current settings, including whether a custom return-path is used.
2. Publish the bedrock2048._domainkey CNAME record in advance, as above.
3. Remove the sending domain in Lime Marketing, then add it again.
4. Wait for the new record to validate, and leave the old bedrock._domainkey record published.
5. Re-check any other settings for the domain, such as the custom return-path.

The domain cannot be used for sending while it is removed. Between removing and re-adding the domain, and until the new DNS record has been validated, the domain is not available for sending. Plan the change for a time when no send is scheduled, and be aware that it also affects transactional email using that domain.

DMARC

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to enhance email security. It helps domain owners protect their domains from unauthorized use, such as phishing and email spoofing. Here’s how it works:

Domain owners publish a DMARC policy in their DNS records, specifying how receiving email servers should handle emails that fail SPF and/or DKIM checks. The policy can instruct the receiving server to quarantine or reject such emails. DMARC requires alignment between the domain in the "From" header and the domains used in the SPF and/or DKIM checks, ensuring that the email is genuinely from the stated sender.

DMARC provides reporting mechanisms, enabling domain owners to receive reports on email authentication results. These reports help identify and mitigate abuse of their domain. By enforcing DMARC policies, domain owners can significantly reduce the risk of their domain being used in phishing or spoofing attacks, thereby protecting their brand and improving email deliverability.

Alignment

DKIM and SPF alignment are crucial components of DMARC. DMARC uses these alignments to decide whether an email passes or fails authentication, helping to protect against email spoofing and phishing attacks. When DMARC checks passes it significantly increases the trustworthiness of the email, reducing the likelihood of it being marked as spam or malicious.

Lime Marketing emails always pass DMARC checks

All emails sent from Lime Marketing fulfill DKIM alignment hence passing the DMARC check

To further improve using a return-path/mail-from domain aligning with the "From" domain also makes the SPF alignment check pass.

DMARC tooling present valid DMARC as invalid when not passing SPF alignment

Some DMARC compliance tools can make it seem something is wrong with emails from Lime Marketing due to by default not passing SPF alignment checks. Since DKIM alignment check passes DMARC also passes. To also pass SPF alignment checks setup a custom return-path matching the sending domain used as "From".

Custom Return-path

A return-path/mail-from address is where the receiving server sends email bounce information. This domain also maintains its own reputation that can increase deliverability. It is recommended to add your own return-path domain in order to build and control your own sending reputation and optimize deliverability. By default, Lime Marketing customers use a shared return-path domain.