Rolling out strict DKIM alignment on all outbound relays

2026-10-12 · Engineering · 4 min read

Starting this week, every JayWolfz outbound relay enforces strict DKIM alignment: the domain in the DKIM signature (d=) must match the domain in the visible From header. This is a small change with an outsized effect on where your mail lands.

Why alignment matters

Receivers like Gmail and Outlook treat a message as trustworthy when the pieces of its identity agree: the visible sender, the envelope sender, and the cryptographic signature. When a relay signs with its own infrastructure domain instead of yours, the message is technically valid — but the identity chain looks loose, and loose chains score worse.

What changed for you

If you use an @jywlfz.com address, nothing changes except (on average) better placement: your mail was already signed with the right domain. If you attach a custom domain, verify that the DKIM key we provisioned is published and wait for the zone to propagate — the relay will pick it up automatically, usually within an hour.

What if something is misconfigured?

Strict mode doesn't reject mail; it logs. We compare signed and aligned outbound volumes per domain for two weeks before enforcement, so any accidental breakage shows up as a dashboard metric first, not as bounced mail. If your custom domain shows an alignment warning in webmail, the fix is almost always a missing or stale DNS record — the help center has the exact values to paste.

As always — fast, hungry, delivers.

— The relay team

← Back to blog