Skip to main content
To ensure email deliverability, Kibo recommends you implement SPF and DKIM email security protocols as part of your domain.

​
SPF

SPF is an email authentication protocol that helps prevent email spoofing and phishing attacks by verifying the sender’s domain. To add SPF validation, provide spf.kibocommerce.com in your SPF include. For example, if you are sending emails from the domain “kiboclient.example.com”, you should have an SPF TXT record that looks like the following: dig kiboclient.example.com txt

​
DKIM

DKIM (DomainKeys Identified Mail) is another important email authentication protocol that helps prevent email spoofing by adding a digital signature to email messages. The DNS records you need to add depend on which platform your tenant is hosted on:
You can tell which platform your tenant runs on by looking at the host in your Admin URL: GCP-hosted tenants include gcp.kibocommerce.com in the host, for example t1000000.sb.usc1.gcp.kibocommerce.com. If you are unsure, ask in your Kibo Support ticket and Kibo will confirm before you make any DNS changes.

​
DKIM for AWS-Hosted Tenants

You will need to add another TXT record. You can choose either “default”, “kibodkim”, or another selector of your choice.
The values should be similar to this example:
After adding this record, please submit a Kibo Support ticket specifying the selector you have chosen so that Kibo DevOps can add this record to the DKIM database.

​
DKIM for GCP-Hosted Tenants

On GCP, Kibo signs outbound email through its email delivery provider rather than through the DKIM signing database used in AWS environments. DKIM is therefore configured as a set of CNAME records that Kibo generates for your sending domain, and the TXT record described above will not work. Because Kibo must generate the records before you can add them, this process starts with a support ticket rather than with a DNS change.
Important: Do not add a _domainkey TXT record on a GCP-hosted tenant. If you have already added one following the AWS instructions, it must be deleted before the CNAME record for the same hostname can be created; DNS does not allow a CNAME and a TXT record to coexist on the same hostname.
  1. Submit a Kibo Support ticket requesting DKIM setup. Include:
    • Each sending domain you want authenticated, for both production and non-production, for example orders.example.com and non-prod.orders.example.com
    • Your tenant ID and environment
    • The DKIM selector you would like to use, if you have a preference
  2. Kibo DevOps creates a domain authentication for each sending domain and returns the DNS records you need to add. You will receive a set of records similar to the following, where the target hostnames are specific to your domain:
  3. Add the records to your DNS exactly as Kibo provides them. Add all of the CNAME records: a domain authentication that is missing any one of them cannot be verified.
    • If a _domainkey TXT record already exists for one of these hostnames, delete it first.
    • If you already use the same DKIM selectors for another email provider, tell Kibo. Kibo can generate the records under a different selector so that your existing DKIM configuration keeps working.
    • Keep the SPF record described in the SPF section. The em#### CNAME record is part of the domain authentication and does not replace your SPF include.
    • Set the DMARC policy to match your organization’s requirements. If you already publish a DMARC record, keep your existing one rather than overwriting it.
  4. Reply to the support ticket when the records are live. Verification is a manual step on Kibo’s side, so the domain authentication does not complete until Kibo confirms your records.
  5. Kibo DevOps verifies the domain authentication and confirms in the ticket that your sending domain is authenticated.
To check your own records before replying to the ticket, query them as CNAMEs rather than TXT records:
Each command should return the target hostname Kibo provided. A command that returns nothing means the record is missing or has not propagated yet.