Invoice Email Domain Troubleshooting and FAQ

Most setup problems come from how a DNS provider stores a record. Keito’s setup has a Record not found? Common DNS provider behaviours panel with the same checks. Start with the status Keito shows for each record.

A record shows Not found

Keito found nothing at that host name. Check, in this order:

  1. The host has your domain twice. Many providers add your domain to the host automatically. If you pasted the full host, the record may be _keito-verification.acme.example.acme.example. Edit it so the host field holds only _keito-verification (or <token>._domainkey).
  2. A typo in the host. Compare it with Keito character by character, including the leading underscore and the dot before _domainkey. Use the Copy buttons rather than retyping.
  3. The wrong record type. The ownership record must be TXT; the three DKIM records must be CNAME. A DKIM key published as a TXT record isn’t what Keito checks.
  4. The wrong DNS provider. The records must be at the provider that hosts your DNS. See Find who hosts your DNS.
  5. Private DNS only. Keito uses public DNS resolvers. Records on an internal DNS server aren’t visible.
  6. Propagation. New records can take time to appear, and a lookup Keito made before you published can be cached for a while. Wait, then select Check DNS.

You can confirm what the internet sees with dig or nslookup; see Check the records yourself.

The ownership record shows Different value found

A TXT record exists at _keito-verification, but it doesn’t hold the current value. This happens after Regenerate record, or when a value from an earlier setup is still published. Replace the old value with the one Keito shows now. Select Show value again if the value is hidden.

Other TXT records at the same host don’t cause a problem; Keito ignores them.

A DKIM record shows Points elsewhere

The CNAME exists but its target isn’t the one Keito expects:

  • Your domain was added to the target. If the target reads <token>.dkim.amazonses.com.acme.example, re-enter it exactly, or with a trailing dot if your provider supports one.
  • Proxying or flattening. At Cloudflare, set the record to DNS only and turn off CNAME flattening for it. Other providers have similar options.
  • A chain of names. The CNAME must point straight at the target Keito shows, not at another name that points there.
  • Mixed-up records. Each of the three hosts has its own target. Check that each host is paired with its own value.

DNS server error or DNS timed out

Your domain’s DNS servers didn’t answer Keito’s lookup, often because of an outage or a DNSSEC problem at the DNS provider. Keito treats this as unknown rather than as a removed record. It keeps the last good result and retries automatically, so an active domain keeps sending while its last successful check is recent.

If the error persists, ask your DNS provider to check the zone. Sending is held only once Keito can’t confirm the domain for longer than its freshness window, about 15 minutes.

Conflicting records at the same host

A host name can hold a CNAME record or other record types, never both. If your provider refuses a CNAME because a record already exists at that host, remove the other record at that exact DKIM host first. Keito’s hosts are dedicated names, so this is rare.

Never remove or replace the MX or SPF records at your domain’s root to make room for Keito’s records. They live on different host names.

Setup errors

Message What to do
“This domain cannot be used as an invoice sender domain” Use a business domain you control, not a shared mailbox provider, an IP address, or a Keito address.
“This domain cannot be set up for this workspace” Another Keito workspace has a setup or an active sender on this domain or a domain under the same parent, such as billing.acme.example and acme.example. If you believe it is yours, contact support. Keito never shows which workspace.
“Another domain setup is already in progress” Finish that setup, or disconnect it, before starting another.
“This workspace has reached its domain setup limit for now” Three setups can be started in any seven days. Contact support to continue sooner.
“This domain is already set up” Use Edit sender details to change the mailbox or display name on a domain you already use.
“The previous setup for this domain is still being cleaned up” Wait until the old setup shows Disconnected, then try again.
“This domain setup expired after seven days” Start a new setup.
“This domain is already configured elsewhere with the email provider” Contact support.
“Manual checks are limited to a few per hour” Keito keeps checking automatically. Try Check DNS again later.

Frequently asked questions

Will this change my website or my mailbox?

No. The records only authenticate invoice email. Your website, MX records, mailboxes, and email from other services keep working as before, and Keito never edits your DNS.

Should I use a subdomain or my main domain?

Either works. Choose based on where you want replies and how you manage DNS:

  • Main domain, such as billing@acme.example: the simplest choice when that mailbox already exists. Your clients see your familiar domain.
  • Subdomain, such as invoices@billing.acme.example: keeps invoice sending separate from the rest of your domain. The records go under the subdomain, and the From mailbox needs mail delivery for the subdomain if anyone replies to it. A Reply-To on your main domain helps.

If a subdomain has no DMARC record of its own, the policy at your main domain applies to it through sp=, or p= when there is no sp=. Keito’s advisory shows which one applies.

Where do replies go?

Replies go to the Reply-To you set for the domain. If it’s blank, they go to the Reply-to email in Client-facing email, or to the person who sent the invoice. The send dialog always shows the Reply-To before you send. Some people reply to the From address anyway, which is why that mailbox must exist and be monitored.

What happens when an invoice email bounces?

Keito records the bounce on the invoice, which shows Invoice email not delivered with the address and the reason. Check the address and resend, or download the PDF and send it yourself. Bounce notifications can also arrive in the From mailbox, which is another reason to monitor it. A high rate of bounces or spam complaints can make the email provider pause sending for your workspace; see When invoice emails are held.

Will my invoices stop going to spam?

Aligned DKIM on your own domain means receiving servers can confirm the email is authorized by you, which is a strong signal for mail providers. It doesn’t guarantee inbox placement: content, your domain’s reputation, and each recipient’s own filters still matter. Send a test email and check its headers after activation.

Do I need to change my SPF or DMARC record?

No. Aligned DKIM satisfies DMARC, and SPF isn’t aligned for Keito’s email. Keito never asks you to weaken a DMARC policy. See DMARC, DKIM, and SPF.

Can I remove the ownership TXT record after setup?

No. Keep all four records published for as long as you send from the domain. Keito checks them every 15 minutes and holds invoice emails if one is missing.

Can I send from more than one domain?

A workspace sends from one domain at a time. To move to another domain, use Replace sender domain, which retires the old one when you activate the new one.

What if the setup is waiting and I close the page?

Nothing is lost. Keito keeps checking in the background, and the setup reopens at the right step when you come back. It must be verified within seven days.

What do I quote to support?

Quote the Reference or Support reference shown on the card, notice, or dialog. It lets support find the exact event. Never send the ownership value in a support request.