Docs

Set up DKIM

Set up DKIM

DKIM adds a signature to every message your mail system sends. The receiving server looks up a public key in your DNS and checks that the message really came from a system holding your private key and was not changed on the way. Unlike SPF, the signature survives forwarding, which makes DKIM the part of email authentication that DMARC relies on most. Gmail and Yahoo expect it from every sender, and without it more of your mail lands in spam.

How the checklist looks for it

A DKIM key lives at <selector>._domainkey.example.com, and the selector is a name your mail provider picks. Nobody can list all selectors of a domain, so the site checklist tries the common ones:

google, default, selector1, selector2, k1, s1, mail, dkim

Provider Selector
Google Workspace google (unless you changed it)
Microsoft 365 selector1, selector2
cPanel, Plesk default
Mailchimp k1
DirectAdmin x
many other services their own name

When it finds a key, the item shows the selector. When it does not, it shows – instead of a failure, because your key may simply be under a name we do not try (DirectAdmin's x, for example). If you know DKIM is set up and the check below finds your key, nothing is wrong.

Check it yourself

Use the selector of your provider and replace example.com with your domain:

dig +short TXT google._domainkey.example.com
dig +short TXT selector1._domainkey.example.com

Microsoft 365 publishes CNAME records that point to Microsoft, so dig follows them and prints the key at the end.

To find the selector of a message you already sent, open it in Gmail (⋮ → Show original) or another client's "view source", and look for the DKIM-Signature: header. The d= tag is the domain, s= the selector. Under Authentication-Results you should see dkim=pass header.d=example.com.

Fixed means a TXT answer that contains v=DKIM1 and a long p= value.

How to fix

DKIM has two halves: the mail system must sign (a setting at your mail provider), and the public key must be in DNS (a record at your DNS host). Turning on signing without the record, or the other way around, does nothing. Pick the system that sends your mail.

Google Workspace

  1. In the Google Admin console open Apps → Google Workspace → Gmail → Authenticate email.
  2. Select the domain and click Generate new record. Keep the key length at 2048 and the selector prefix at google.
  3. Copy the shown TXT record (name google._domainkey, value starting with v=DKIM1; k=rsa; p=) and add it at your DNS host (see its tab).
  4. Wait until the record is visible with dig (usually within an hour), then return to the same page and click Start authentication. The status changes to Authenticating email.

On a brand-new Workspace account the option can take a day or two to appear. If your DNS host refuses the long value, use 1024 bits, or see the note on long keys below.

Microsoft 365

  1. Open the Microsoft Defender portal and go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
  2. Click your domain. Microsoft shows two CNAME records it needs.
  3. Add both at your DNS host, with the values exactly as shown:
Type Name / Host Value (example, use yours) TTL
CNAME selector1._domainkey selector1-example-com._domainkey.contoso.onmicrosoft.com 3600
CNAME selector2._domainkey selector2-example-com._domainkey.contoso.onmicrosoft.com 3600

Newer tenants get a different target format; always copy what the portal shows.

  1. After the records are visible, turn on Sign messages for this domain with DKIM signatures for the domain. Microsoft rotates between the two keys itself, which is why there are two.

cPanel

  1. Open Email → Email Deliverability.
  2. If DKIM shows a problem next to the domain, click Manage (or Repair). cPanel creates a 2048-bit key under the selector default and adds the record to its own DNS zone.

If the domain's DNS is hosted elsewhere (Cloudflare, the registrar), cPanel says the record is missing even after the repair. Copy the suggested default._domainkey TXT value from the same screen and add it at your DNS host.

This only signs mail that leaves through the cPanel server (website forms, mailboxes on the host). Mail sent through Google Workspace or Microsoft 365 needs its own DKIM there.

Plesk

  1. Server-wide, the administrator must allow DKIM: Tools & Settings → Mail Server Settings, option Allow signing outgoing mail.
  2. For the domain: Websites & Domains → example.com → Mail Settings (in newer versions Mail → Mail Settings), turn on Use DKIM spam protection system to sign outgoing email messages and click OK.

Plesk adds the default._domainkey record to its own DNS. If the domain uses external DNS, copy that record from Hosting & DNS → DNS in Plesk and add it at your DNS host.

DirectAdmin

DirectAdmin signs with the selector x, so the checklist shows – for it even when DKIM works. Check with:

dig +short TXT x._domainkey.example.com

If there is no answer, DKIM is not enabled for the domain. Depending on the host's setup there is a DKIM option in the domain's email settings or in Account Manager → DNS Management; if you do not see one, ask the host to enable DKIM for the domain. If DNS is hosted elsewhere, copy the x._domainkey record from DNS Management to your DNS host.

Cloudflare

Cloudflare does not send your mail and does not sign it. If your DNS is on Cloudflare, it is where you add the record your mail provider gives you:

  1. Open the domain and go to DNS → Records → Add record.
  2. For Google Workspace, cPanel or Plesk: type TXT, name e.g. google._domainkey, content the full value starting with v=DKIM1.
  3. For Microsoft 365: two records of type CNAME (selector1._domainkey, selector2._domainkey) with Proxy status set to DNS only (grey cloud).
  4. Save.

Cloudflare accepts long values and splits them correctly.

DNS provider

Add the record your mail provider gave you in your DNS zone:

Type Name / Host Value TTL
TXT google._domainkey v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC… 3600

Type the name without your domain (google._domainkey) unless your provider asks for the full name; otherwise you get google._domainkey.example.com.example.com.

Long keys

A 2048-bit key is about 400 characters, and a single string in a TXT record may be at most 255. Good editors split it automatically. If yours cuts the value off or shows an error, enter it as several quoted strings one after another, without anything in between:

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..." "...rest of the key...IDAQAB"

Receivers join the strings back together. A truncated key fails silently: dig shows a record, but every signature fails.

Confirm the fix

Run the dig command from Check it yourself again and send yourself a test message to a Gmail address: Show original should say DKIM: 'PASS' with domain example.com. Then open the target in PulseKeeper and click Check now on the Checklist tab. If your provider uses one of the common selectors, the item turns OK within a few minutes; otherwise it stays –, and that is fine.