Greenby email now with DKIM

[#1]

Today I noted in the Greenby portal Email Settings DKIM is now set to ON & it is working for our email accounts when sending via a Greenby SMTP server such as mail.enmail.co or via relay.force9.net

The Greenby DKIM is at the <account>.plus.com level.
that is each customer now has a distinct DKIM Signature from their own DNS record.

Fingers crossed having "DKIM=PASS" will help with the delivery to the ultra picky free-mail operators.

[#2]

@PhilipHeyes 

"The Greenby DKIM is at the <account>.plus.com level."

Yes, but is it enabled? 

	Related Tests	Result
	DMARC Policy Not Enabled	It is recommended to use a quarantine or reject policy. To enable BIMI, it is required to have one of these at 100%.	More Info
	DMARC Record Published	DMARC Record found

This appears no different to when I posted yesterday for my own account: Gmail again! - Plusnet Community

spf: <User>.plus.com

Related Tests Result
Status Problem DMARC Policy Not Enabled
It is recommended to use a quarantine or reject policy. To enable BIMI, it is required to have one of these at 100%. Information More Info

Status Ok DMARC Record Published DMARC Record found
dns lookup smtp diag blacklist http test dns propagation
Reported by ns1.plusnet.co.uk on 6/14/2026 at 11:52:32 AM (UTC -5), just for you.

[#3]

DKIM is now working on our a/c along with DMARC & SPF.

See below :

Authentication-Results: btinternet.com;
    dmarc=pass header.from=<account>.plus.com;
    dkim=pass;
    spf=none smtp.helo=arabellina.gateway.enmail.co;
    spf=pass smtp.mailfrom=<account>.plus.com;
    arc=none smtp.remote-ip=213.5.178.136

[#4]

I have just tried dmarctester  for my <account>.f9.co.uk and only SPF is present - no DKIM or DMARC.

This is sending using relay.force9.net - which I believe is the only one using a Greenby SMTP server currently!

[#5]

At the end of the day we have no real idea of why Gmail is rejecting messages. The Gmail system gives a 'reason' with its rejection message, but what that actually MEANS is anybody's guess.

It always seems simple and clear: my recent message was returned because, apparently, I am sending "too many emails from your 'domain' <User>.plus.com" - which is clearly nonsense!

At least it is nonsense from the 'domain' <User>.plus.com, as I should know. But... if the real 'domain' is actually plusnet.com then I wouldn't know. (Apart from suspecting there IS a lot of mail coming from that domain). But they quote my 'domain'.

Now you might say: "How do you know somebody isn't spoofing your email address?". Well, because I don't get spam mail myself, nor do I get irate messages from strangers saying "Stop spamming me you ******!", as I believe some Plusnet users have reported.

So... can my (and others') Plusnet 'domain' <User>.plusnet.com be highjacked, using dummy user email addresses to send out spam, that I would then be unaware of, as I would not get any replies at my address? I don't know. Does anyone here?

[#6]

..."It always seems simple and clear: my recent message was returned because, apparently, I am sending "too many emails from your 'domain' <User>.plus.com" - which is clearly nonsense!"

The exact wording was:

"Diagnostic-Code: smtp; 421-4.7.28 Gmail has detected an unusual rate of mail originating from your SPF 421-4.7.28 domain [<User>.plus.com 35].
To protect our users from spam, 421-4.7.28 mail sent from your domain has been temporarily rate limited."

That's after ONE email from me to one person with a Gmail account.

I have not got a Gmail account and, on the evidence before me, I wouldn't want one! Reason being, I likely would not receive most of my emails...

[#7]

I have just been told by Greenby support, in response to my latest query about my 7-month old ticket about hotmail...

We have already started enabling the required authentication records for all the customers, and they will also be enabled for your domain within two days (including normal DNS propagation).

This seems to maybe explain the first post above, and gives me (and maybe some others) some hope at long last!

[#8]

Well, something appears to have changed! Let's hope it's permanent.

I send another email today to the same Gmail recipient as the recent failed one and, according to a Delivery Receipt it got through.

Though https://mxtoolbox.com/SuperTool.aspx is still reporting "DMARC Policy Not Enabled" for my 'domain' <User>.plus.com

This is the mail system at host gateway1.enmail.co.

Your message was successfully delivered to the destination(s)
listed below. If the message was delivered to mailbox you will
receive no further notifications. Otherwise you may still receive
notifications of mail delivery errors from other systems.

The mail system

<******@gmail.com>: delivery via
gmail-smtp-in.l.google.com[142.251.127.26]:25: 250 2.0.0 OK 1781589498
ffacd0b85a97d-4606f28da53si20359120f8f.69 - gsmtp

--E528A4122D.1781589482/gateway1.enmail.co
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; gateway1.enmail.co
X-Postfix-Queue-ID: E528A4122D
X-Postfix-Sender: rfc822; ******@<User>.plus.com
Arrival-Date: Tue, 16 Jun 2026 05:35:03 +0000 (UTC)

Final-Recipient: rfc822; ******@gmail.com
Original-Recipient: rfc822;******@gmail.com
Action: relayed
Status: 2.0.0
Remote-MTA: dns; gmail-smtp-in.l.google.com
Diagnostic-Code: smtp; 250 2.0.0 OK 1781589498
ffacd0b85a97d-4606f28da53si20359120f8f.69 - gsmtp
  

[#9]

"DMARC Policy Not Enabled" for my 'domain'

All this means is the DMARC configuration at the plus.com level does not say what to do in the event of a DMARC=FAIL situation, so Greenby / Plusnet emails are delivered to you unlike GMAIL / iCloud that would bounce the message.

Here is the DMARC record that you & I share from the plus.com DNS entry :

>nslookup -type=TXT _dmarc.plus.com
Server:  cache1.service.virginmedia.net
Address:  194.168.4.100

Non-authoritative answer:
_dmarc.plus.com text =

"v=DMARC1; p=none; sp=none; fo=1; ri=3600; rua=mailto:[email protected]; ruf=mailto:[email protected]"

[#10]

@PhilipHeyes 

"All this means is the DMARC configuration at the plus.com level does not say what to do in the event of a DMARC=FAIL situation, so Greenby / Plusnet emails are delivered to you unlike GMAIL / iCloud that would bounce the message."

Right. Then that's sounds the best approach to me, rather than the Gmail one which seems to guarantee loss of mail to recipients.

Then again, AFAIK, Greenby already had a DKIM record available* for my 'domain' <User>.plus.com (according to https://mxtoolbox.com/SuperTool.aspx) when my original email to a Gmail account was bounced by Gmail. So perhaps this was all some kind of DNS 'race' issue?

* Gmail again! - Plusnet Community

"And yet, for me..."

[#11]

@pvmb re #6

I'm still getting the same rejection as you when sending a test email from my plus.com address to my gmail.com address. Gmail takes typically 70 minutes to come up with this nonsense. In my case, the rate seems to be limited to zero! Like you, I don't think my address is being used for spam purposes so I'm puzzled as to how they have come up with this particular message and why isn't every Plusnet email user getting it?

[#12]

@abitpedantic 

I succeeded yesterday in sending an email to somebody on Gmail, after failure previously. I remain to be convinced and have just sent them another one to see what happens.

P.S. Well, it has just been reported as Delivered. So perhaps things are looking up at last. Have you tried again?

[#13]

It's still just the same, wait 70 minutes and then the 421-4.7.28 rejection message arrives. If the message can be believed, it doesn't seem to have anything to do with DKIM so I'm not optimistic that the problem will go away.

[#14]

This morning, for the first time for many months, an email I sent to a hotmail address from my <user>@<account>.f9.co.uk address has arrived safely!

However, I am rather surprised to see that:
1. Email headers now seem to contain TWO DKIM-Signature entries - is that normal?
2. DMARC does not yet seem to be implemented, according to dmarctester.com.

[#15]

Apparently (from support)...

DKIM duplication

Yes, this can be expected. During the migration and authentication rollout, messages may be signed by more than one DKIM key as they pass through different parts of the mail infrastructure. As long as at least one valid DKIM signature aligns correctly with the sending domain, this is not a cause for concern.

Missing DMARC

We are currently reviewing and enabling the appropriate DMARC configuration for migrated domains.