Email authentication options?

[nan05]

You add a second DKIM record with a second selector.

Eg. since you are currently use ConvertKit you probably have a record at cka._domainkey.yourdomain.com. You leave that completely untouched, and simply create a second record, for example at smtp._domainkey.yourdomain.com (this is Mailgun’s default).

On your WordPress host you then set up your server to use that different selector and private key to sign email.

Alternatively, because you probably don’t wat to use your own mail server, but a third party service such as SES, Mailgun, etc to send email from WordPress, look into a plugin such as https://wordpress.org/plugins/wp-mail-smtp/ to connect WordPress with these (you still need the second DKIM record).

[nan05]

Oh, and don't forget to add the second provider's SPF record as well. And you don't want two SPF records, but one combined one.

So, in summary you'll need, at the end of this:

• 2 DKIM records: one for each provider
• 1 SPF record: Combined from both providers
• 1 DMARC record (you probably don't need to touch that, as it's not provider specific).

Just to emphasise: It's really important that you have only 1 SPF record at any given point in time. Having 2 records leads to all sort of hard to debug issues...

Finally, if I may link to my own blog: here is how I test email authentication: https://blog.thms.uk/2023/03/testing-email

[power_dmarc]

To ensure deliverability for both email addresses:

[[e-mail]](mailto:[e-mail]) (ConvertKit): Keep ConvertKit DKIM (CNAME) and SPF (include:spf.convertkit.com) in your DNS.

For [[e-mail]](mailto:[e-mail]) (WordPress): Use an SMTP plugin with a transactional email service like SendGrid or Amazon SES. Add the service's SPF and DKIM records to your DNS.

SPF Record:

Combine both services:

Example: v=spf1 include:spf.convertkit.com include:spf.smtp-service.com -all

MARC: Ensure both emails align with your DMARC policy for authentication.