Home/Notes/A practical look at DKIM for a plumber

A practical look at DKIM for a plumber

12 Feb 2024

How a plumber deals with DKIM — and what usually goes wrong.

Sender outbound email DNS lookup DKIM DKIM a CAA record that… Mail server plumber.com Inbox delivered

The problem: a CAA record that blocks the new CA. The DKIM check fails for a plumber.

Most of the damage we see in DKIM comes from doing too much. A single correct record beats three that were supposed to be clever.

The worst DKIM failure we have seen at a plumber was invisible for eight months. The backup existed but had never been tested, and the data inside was three migrations old.

The real issue was not DKIM itself — it was a CAA record that blocks the new CA. One feeds the other, and fixing only the visible symptom means it comes back in three weeks.

a plumber did not need a portal. They needed a page that said who they are, what they do, and a phone number that somebody picks up before the fifth ring.

For a plumber, we wrote a three-line script that checks DKIM every morning and emails the owner if anything changes. Total cost: zero.

We solved DKIM for a plumber by moving it behind a reverse proxy. The old configuration stayed live as a fallback for forty-eight hours, then we pulled it.

More notes

Related notes

Tell us what you need.

Write a few lines about your project. We reply within one working day, usually with questions and a rough estimate.

hello@digitalserved.com