DKIM lifecycle
Open the owned domain's Email Deliverability/tools view. The DKIM configuration records enabled state, selector, public TXT material, public-key SHA-256, lifecycle state and verification time. Use stage to create the supported new candidate and publish the exact returned public TXT record in the actual authoritative zone. Use verify after propagation; do not invent a TXT value or expose the private signing key.
The typed routes are POST /v1/mail-domains/{id}/dkim/stage and /dkim/verify. Keep the selected account/domain and current revision consistent. Rotating a selector requires the supported lifecycle and independent mail-signing verification, not overwriting private key files.
SPF and DMARC requirements
Read the domain's reported DNS requirements and compare them with authoritative public answers. SPF authorizes the actual sending infrastructure; DMARC policy depends on your real alignment and rollout needs. Do not copy another server's addresses or declare authentication passed from a local record alone. Panel has no registrar integration to change parent DNS automatically.
Deliverability checks
GET /v1/mail-domains/{id}/deliverability reports current evidence. The explicit /deliverability/test action runs its supported bounded checks; actual SMTP sending is an external effect and should use only a recipient you control and intentionally authorize. Compare service/listener state, DNS, PTR where applicable, signed-message headers, relay refusal, delivery queue and actual recipient inbox. A single automated diagnostic is not a reputation guarantee.
The Customer own-domain tools and Admin server-mail workspace are different scopes. Administrator menu leaves for domain deliverability and SPF/DKIM/DMARC are explicitly unavailable in the server view; do not assume the customer editor is an unfiltered administrator feature.
Webmail
Customer Webmail loads GET /v1/mail-webmail and uses only the supported installed capability. The existence of the menu does not install a webmail application or provide arbitrary remote URLs/credentials. Verify the actual reviewed origin, TLS and login; never reuse the Panel administrator password as a mailbox password.
Troubleshooting
For pending DNS, inspect the authoritative nameservers and TTL, not just the server resolver cache. For an unavailable listener, stop and complete the separately reviewed service exposure. For failed DKIM verification, compare selector, exact TXT chunks and expected public-key digest; retain old working state according to the supported rotation process. Do not disable TLS verification or global anti-abuse controls to manufacture a successful test.