DKIM for Dummies: What is DKIM and How to Explain It to Your IT Team

If your nonprofit sends emails with Raiser’s Edge NXT, Luminate Online, or Online Express, you need to know about DKIM. DKIM, or DomainKeys Identified Mail, helps determine if your emails reach your donors’ inboxes or get stuck in spam. 

Setting up DKIM is not optional – it’s essential. Whether you manage your database, run fundraising campaigns, or reach out to donors, understanding DKIM is important. It helps protect your email delivery, your domain’s reputation, and your fundraising success. This guide explains it all! 

What is DKIM?

DKIM stands for DomainKeys Identified Mail. It’s a way to sign your organization’s emails digitally. This shows they are real and came from you, not a scammer. 

Think of it like a tamper-proof seal on a letter. When the email is delivered, the receiving server can check the seal with a public key. This ensures that nothing was changed during delivery. If everything matches up, the email is considered safe and authentic. 

Why Does DKIM Matter for Blackbaud Users?

If you send emails using Blackbaud tools like Raiser’s Edge NXT, Online Express, or Luminate Online, set up DKIM. This helps your emails reach inboxes, especially with Google and Yahoo’s email security updates in 2024. Without DKIM, your messages could end up in spam or blocked entirely. Since these emails are sent through Blackbaud’s servers, DKIM acts as a “tamper-proof seal” that verifies they are legitimately from your domain. This is a common requirement for other email services like MailChimp and Constant Contact to ensure deliverability and security. 

What’s the Fastest Way to Explain DKIM to IT?

Here’s your cut-and-paste message for IT (feel free to send this to your tech team):  

Hi IT Team,

We need to set up something called DKIM (DomainKeys Identified Mail) for our Blackbaud emails.

It’s basically a way to add a digital signature to the emails we send through Blackbaud tools (like RE NXT or Luminate Online) to prove they really came from us.

Blackbaud Support will provide us with a DKIM public key that we need to publish in our DNS records. After that’s done, Blackbaud handles the rest, and it helps improve our email deliverability.

For more details, here’s a helpful Blackbaud resource: Blackbaud Email Resource Center. 

Can you help us add the DKIM public key to our DNS when we get it? 

Thanks! 

Which Blackbaud Tools Use DKIM?

Here’s a quick list of Blackbaud products that support DKIM: 

• Raiser’s Edge NXT Email 

• Online Express 

• Luminate Online 

• eTapestry (both Advanced Mass Email and Basic Bulk Email) 

• Blackbaud NetCommunity 

• Altru 

• Financial Edge NXT 

• Blackbaud Award Management 

• Blackbaud Stewardship Management 

What Do I Actually Need to Do to Set Up DKIM? 

• Contact Blackbaud Support. Tell them you want to set up DKIM for your email sending domain

• Get your DKIM keys. Blackbaud will give you a public key — that’s what IT needs

• Work with IT to publish the public key. IT will add the public key to your domain’s DNS settings. (It usually takes 24-72 hours to fully update.

• Blackbaud finalizes the setup. Once the public key is published, Blackbaud will complete the DKIM setup on their end. 

How Do I Know If It’s Working?

You (or IT) can check if DKIM is properly set up using tools like MXToolbox DKIM Lookup. 

• Use your domain name (the part after the @ in your email address) 

• Use “sm” as the selector (that’s what Blackbaud uses) 

If it shows a valid key, you’re good to go! If not, you may need to double-check the DNS entry. 

What Happens If We Don’t Set Up DKIM?

Without DKIM, your emails are: 

• More likely to land in spam folders 

• At higher risk of being rejected by inbox providers like Gmail or Yahoo 

•  More vulnerable to spoofing (where someone pretends to send email from your domain) 

You must use DKIM if you want to reach your donors reliably. 

What’s the Difference Between DKIM and DMARC? 

• DKIM is the digital signature that proves the email came from you.

• DMARC is the policy you set up that tells inbox providers how to handle emails that don’t pass DKIM (or SPF) checks.
• Together, DKIM + DMARC are your email security dream team.
   

Final tip? Start now! Even if you’re not currently running a year-end campaign, setting up DKIM early helps your emails reach inboxes when it matters most.