Customer Hosted Gateway DNS Entries – Virtru

Purpose

DNS entries are required post-implementation to help prevent delivery issues and ensure that emails processed through the Virtru Customer-Hosted Gateway are not marked as spam, junk, or rejected—especially by recipients with strict email security policies.

These DNS records must be created for each domain that will send mail through the Virtru Gateway.

Important – DKIM Configuration

When publishing the DKIM public key in your DNS, verify that the entire public key is present and has not been truncated by your DNS provider or management interface. Some DNS providers impose character limits or UI restrictions that can result in an incomplete TXT record, causing DKIM verification failures.

Additionally, ensure that the value of the GATEWAY_DKIM_SELECTOR environment variable exactly matches the selector used in the DNS record (for example, gw._domainkey.yourdomain.com). A selector mismatch or an incomplete public key can result in errors such as dkim=permerror (no key for signature).

Key Requirement: DKIM Record

Whether the Virtru Customer-Hosted Gateway is making the final delivery or passing mail to another hop, it is important to always have the DKIM record in place.

Follow the steps to generate DKIM keys:

How to Create the DKIM Record

Open the Public Key File:

/var/virtru/vg/dkim/gw._domainkey.<yourdomain.com>-public.pem

Copy the Public Key:
Copy only the content between:

-----BEGIN PUBLIC KEY-----
(Your key here)
-----END PUBLIC KEY-----

Create the TXT Record in Your DNS Provider:
- Name: gw._domainkey.<yourdomain.com>
- Type: TXT
- Value: v=DKIM1; k=rsa; p=<your copied dkim public key>
- TTL: 6000 (or your preferred TTL value)

Example: DNS Records for One Domain

Name	Type	Value	TTL
gw._domainkey.yourdomain.com	TXT	v=DKIM1; k=rsa; p=<your copied dkim public key>	6000

Each domain sending mail through the Virtru Gateway must have a unique DKIM TXT record using the public key generated for that domain.

Optional but Recommended DNS Entries

2. A Record (Recommended for Direct Routing)

Purpose:
Resolves the Virtru Gateway FQDN to its public IP address.

Name	Type	Value (Gateway Public IP Address)	TTL
gw.<yourdomain.com>	A	e.g., 123.123.123.123	6000

Notes:

Recommended if the Virtru Gateway is making final delivery.
Useful when you have multiple servers routing through an FQDN, such as gw.<yourdomain.com>.

3. SPF Record (Strongly Recommended)

Purpose:
Identifies servers authorized to send mail on behalf of your domain and helps prevent sender address spoofing.

Example SPF Record:

v=spf1 ip4:<Gateway Public IP> include:_spf.google.com ~all

ip4: Public IP of your Virtru Gateway.
include:_spf.google.com ( Add your next hop (e.g., Google, Microsoft, Barracuda) to account for mail relayed through those systems.)
~all: Soft fail for any senders not listed.

Name	Type	Value	TTL
@	TXT	v=spf1 ip4:123.123.123.123 include:_spf.google.com ~all	6000

SPF Validation Tools:

SPF Resources:

4. PTR Record (Recommended for Reverse DNS)

Purpose:
Helps verify that the sending IP address maps back to the correct domain, improving email trustworthiness.

Set up with your IP provider.
Example: 123.123.123.123 ➔ gw.<yourdomain.com>

Contact your ISP or hosting provider to configure this.

5. DMARC Record (Recommended for Email Security)

Purpose:
Provides domain-level email authentication policy, improves reporting, and protects against spoofing.

Example DMARC Record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@<yourdomain.com>; ruf=mailto:dmarc-failures@<yourdomain.com>; pct=100

Name	Type	Value	TTL
_dmarc.<yourdomain.com>	TXT	v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com	600

Recommendations:

Start with p=none to monitor.
Later update to p=quarantine or p=reject for enforcement.

Step 6: Verify DNS Resolution

After creating the A record, verify it resolves correctly using:

nslookup gw.yourdomain.com
dig gw.yourdomain.com A
dig yourdomain.com TXT