Partner and Multi-Account: Enable and Use Managed DKIM Signatures

You can now configure DKIM signatures at the partner level. This feature allows child accounts to automatically inherit configurations, ensuring consistent email compliance and a streamlined setup across multi-tenant environments.

A KnowBe4 training email includes a DomainKeys Identified Mail (DKIM) signature that verifies it is an authentic KnowBe4 email. You can also enable this feature for phishing emails. This guide will show you how to enable and use an allowed domain as a partner-level DKIM signature for both your managed phishing and training emails.

Adding Managed DKIM Signatures

You can add managed DKIM signatures in the managed partner console. To add managed DKIM signatures to phishing and training emails, follow the steps below.

1. Log in to your managed partner console.
2. Navigate to Account Settings at the top-right corner of the page.
3. Navigate to Phishing > Phishing Settings > Phishing Email Headers.
4. Select the Enable DKIM Signature toggle.
5. Select + Add Domain.
6. From the drop-down menu, select a signing domain.

7. Select Create a DKIM Selector for This Domain.

   

8. After creating a DKIM selector for the domain, you can view its details by selecting the Show details for this DKIM selector button.

   

9. In this pop-up, you can select Validate the DNS TXT record for this DKIM Selector.

   

10. When completed, select Save DKIM Settings. If you would like to delete your DKIM selector, select the Delete DKIM settings button.

11. To add managed DKIM signatures to training emails, repeat the same steps in the Training Email Headers.

Enabling and Using a Managed DKIM Signature for Phishing Emails

You can use partner-level DKIM signatures for your managed phishing emails. See below for steps on how to enable and use partner-level DKIM signatures for managed phishing emails.

1. Log in to your managed KSAT console.
2. Navigate to Account Settings at the top-right corner of the page.
3. Navigate to Phishing > Phishing Settings.

4. In the Phishing Settings section, select the Enable DKIM Signature toggle.

   

5. Select the Use Managed Signing Domain section.
6. Choose the domain you want to use. To add a domain to this drop-down menu, you will first need to add an allowed domain to your managed KnowBe4 account. For more information, see our Partner and Multi-Account: Add and Verify Domains article.
7. Select Use this domain.
8. Copy the host name and values provided in the fields of the pop-up window.
9. Navigate to your DNS provider and add a TXT record containing the copied information.
10. To verify that your DNS provider has recognized the TXT record, select the Validate the DNS TXT record for this DKIM selector button.
11. Once you’ve created the TXT record in your DNS provider, select OK in the DKIM Selectors Details window in your managed KSAT console.
12. Select the Save Changes button at the bottom of your Account Settings page.

Enabling and Using a Managed DKIM Signature for Training Emails

You can also use partner-level DKIM signatures for your managed training emails. To enable and use partner-level signing domains in managed training emails, follow the steps below:

1. Log in to your managed KSAT console.
2. Navigate to Account Settings at the top-right corner of the page.
3. Navigate to Training > Training Settings.

4. Under the Training Settings section, select the Enable Custom DKIM Signature toggle if you haven’t enabled DKIM signatures already.

   

5. Select the Use Managed Signing Domain section.
6. Choose the domain you want to use. To add a domain to this drop-down menu, you will first need to add an allowed domain to your managed KnowBe4 account. For more information, see our Partner and Multi-Account: Add and Verify Domains article.
7. Select Use this domain.
8. Copy the host name and values provided in the fields of the pop-up window.
9. Navigate to your DNS provider and add a TXT record containing the copied information. To verify that your DNS provider has recognized the TXT record, select the Validate the DNS TXT record for this DKIM selector button. If your TXT record exceeds 255 characters, it must be split into multiple entries. For more information, see Pagely's Resolving TXT Record Size Limits Resolving TXT Record Size Limits (link opens in new window) article.
10. Once you’ve created the TXT record in your DNS provider, select OK in the DKIM Selectors Details window in your managed KSAT console.
11. Select the Save Changes button at the bottom of your Account Settings page.

For further assistance with this feature, contact KnowBe4’s support team contact KnowBe4’s support team (link opens in new window).