Verify, Test, and Activate Your Email Domain

After you publish the DNS records from the setup, Keito verifies them, you send yourself a test email, and you activate the domain. Nothing is sent from your domain until you activate it.

How Keito checks your records

Keito looks up your records through public DNS resolvers, the same way mail servers on the internet see them. Records published only on an internal or private DNS server can’t be found.

While a setup is waiting, Keito checks automatically:

  • every minute for the first 10 minutes of each step;
  • every 5 minutes for the rest of the first hour; and
  • every 30 minutes after that.

While the page is open it refreshes on its own, every 15 to 30 seconds while a step is waiting, so a result appears soon after the check that found it.

Check DNS runs a check straight away. Manual checks are limited to six an hour for each workspace. Once you reach the limit, Keito says “Manual checks are limited to a few per hour” and automatic checks continue in the background. Retry cleanup counts toward the same limit.

Propagation and timing

New records usually become visible within minutes, but an earlier lookup can be cached for a while. DNS providers quote up to 48 hours for a change to reach everywhere, and in rare cases DKIM verification takes up to 72 hours. In Keito’s own testing:

  • the ownership record was confirmed within a minute of being published;
  • the email provider issued the DKIM records in a few seconds; and
  • DKIM was verified between 1 and 15 minutes after the CNAME records were published.

Check the records yourself

You can look up a record from your own computer. Query a public resolver so a cached answer on your network doesn’t mislead you:

dig +short TXT _keito-verification.acme.example @1.1.1.1
dig +short CNAME <token-1>._domainkey.acme.example @8.8.8.8

On Windows, use nslookup -type=TXT _keito-verification.acme.example 1.1.1.1.

The TXT lookup should return the keito-domain-verification= value. Each CNAME lookup should return the target Keito shows, ending in dkim.amazonses.com. An empty answer means the record isn’t published under that exact name yet. See Troubleshooting when the answer is wrong.

Record and check statuses

Status Meaning
Not checked yet Keito hasn’t looked up the record since you started this step.
Found The record is published with the expected value.
Not found Nothing exists at that host. Check the host name.
Different value found A TXT record exists but holds another value, often an old value from before you regenerated the record.
Points elsewhere The CNAME exists but points at a different target, or it is proxied or flattened.
DNS server error or DNS timed out Your DNS servers didn’t answer. Keito keeps the last good result and retries automatically.
Failed The email provider reported DKIM as failed. Fix the records and check again.

Send a test email

On the Ready step, and on an active domain’s card, select Send test email. Keito sends one short message from your domain to your own Keito sign-in address. It contains no invoice, PDF, or link. You can send up to five test emails an hour and twenty a day for each workspace.

“Accepted by the email provider” means the provider took the message. It doesn’t mean the message reached an inbox, so open it in your mailbox and check how it was authenticated. Look in spam if it hasn’t arrived.

Check authentication in Gmail

  1. Open the test email.
  2. Select More (the three dots) next to Reply, then Show original.
  3. In the summary at the top, look for DKIM: ‘PASS’ with domain acme.example. If your domain publishes a DMARC record, you should also see DMARC: ‘PASS’.

SPF: ‘PASS’ appears for the email provider’s domain, not yours. That is expected; see DMARC, DKIM, and SPF. Google explains the page in Trace an email with its full headers.

Check authentication in Outlook

  1. Open the test email.
  2. Open its message headers. In Outlook on the web and the new Outlook, select More actions (…), then View > View message details. In classic Outlook for Windows, select File > Properties and look at Internet headers.
  3. Find the Authentication-Results header. It should include dkim=pass with header.d=acme.example. If your domain publishes a DMARC record, it should also include dmarc=pass with header.from=acme.example.

Microsoft explains where to find headers in View internet message headers in Outlook.

Reading the raw headers

Other mail apps call this View source, Show original, or Raw source. In the raw headers:

  • dkim=pass header.d=acme.example (or header.i=@acme.example) is the signature that matters. A second dkim=pass for amazonses.com is the email provider’s own signature and is expected.
  • dmarc=pass means your DMARC policy was applied and passed. dmarc=none means your domain publishes no DMARC record, which isn’t an error.
  • spf=pass refers to the email provider’s return-path domain.

Activate the sender

When the domain is Ready:

  1. Read the summary. It shows the From address and where replies go.
  2. Tick the confirmation: “I confirm that the From mailbox and the Reply-To mailbox exist and are monitored. Proving the domain does not create or check a mailbox.” Without a Reply-To, it mentions only the From mailbox.
  3. Select Use this sender for invoice emails.

If you are replacing an active domain, the step first warns that activating replaces it. See Replace your sender domain.

If activation is refused with “The latest checks are too old”, select Check DNS, wait for the result, and activate again. If Keito says “Activation is not available for this workspace yet”, your records stay verified; email support@keito.ai with your workspace name.

After activation

  • The Email sender card shows your domain as Active, with the From and Reply-To, the date it became active, and when it was last checked.
  • Invoice emails, reminders, thank-you emails, automatic recurring invoices, and Keito payment receipts are sent from your address. Emails sent earlier keep their original sender.
  • The send and resend dialogs show the new From and Reply-To. If the sender changes while a dialog is open, nothing is sent; the dialog shows the new sender and asks you to send again.
  • Keito checks active domains every 15 minutes. Keep all four records published. If a check finds a record missing or changed, invoice emails from your domain are held until it is fixed. Nothing is sent from another address instead. See When invoice emails are held.

To change the mailbox or display name later, or to stop using the domain, see Change, replace, or disconnect your domain.