Column 1
Skip to content
Column 1

DKIM Record Generator Guide: Provider DNS Setup

DKIM helps receiving mail systems check whether a message was signed for a domain. The signature names a signing domain and a selector; receivers use those details to look up the matching public record in DNS. The private signing key belongs with the email service that signs mail. It should never be placed in DNS, uploaded to a website, or sent to support.

DKIM email security with keys and DNS record symbols.

Set up DKIM with the provider that sends your mail

First identify the service that actually sends the mail stream you want to authenticate. That might be your hosted mailbox provider, a transactional email service, a marketing platform, or a hosting mail server. Create or enable DKIM in that provider's administration area. The provider supplies the selector, DNS host or name, record type, and public value that match its signer.

In cPanel, open Email Deliverability, choose Manage beside the relevant domain, and review the DKIM status and any record cPanel provides. That workflow applies to mail managed by that cPanel account. If another provider sends the mail, use that provider's DKIM setup instead.

Know who controls the DNS zone

Your mail provider and your DNS provider may be different companies. Add the record where the domain's active DNS zone is managed, not merely where the website or mailbox is hosted. Use the exact host/name and value supplied by the sending provider. Some providers require a TXT record; others use a CNAME. Follow the provider's instructions rather than assuming one fixed record type.

Publish and verify

  1. Confirm the exact sending provider and the domain it signs.
  2. Copy that provider's selector, host/name, record type, and public value exactly into the active DNS zone.
  3. Save the DNS change, then use the provider's own verification status or documented mail-flow check.
  4. Keep a change record with the provider, selector, DNS-zone owner, date, and verification result.

DNS updates are not synchronous. Allow for DNS caches and the provider's stated verification timing before deciding that a new record has failed.

Common setup mistakes

  • Editing a DNS zone that is not authoritative for the domain.
  • Duplicating the domain suffix when a DNS interface adds it automatically.
  • Using a selector or domain that does not match the sending provider's instructions.
  • Checking before DNS caches have refreshed.
  • Replacing another provider's DKIM record when more than one authorized service sends mail.

The domain visible in a recipient's From address is not automatically the DKIM signing domain. Review the provider's sending-domain and alignment guidance for the mail stream you are configuring.

Rotate keys through the signing provider

When a provider rotates a key or issues a new selector, follow that provider's sequence for publishing the replacement, switching signing, verification, and retirement of the prior record. There is no single universal old-key timer to apply to every provider.

Tool status and FAQ

The previous XML and email-upload helper has been removed from this page. This page does not generate a signing key pair, accept private keys, or accept email, XML, credentials, or other private mail material. Generate or enable signing at the provider that sends your mail, then publish the matching public DNS record it supplies.

Are email headers the public key? No. Headers can show signing details such as a selector and signing domain; the matching public key is published in DNS by the authorized setup.

Does this page create a provider key pair? No. The provider that signs the mail controls its signing key material and setup process.

Does a published record mean the setup is complete? Not by itself. Confirm the provider's verification status after the DNS change.

Does DKIM stop all spoofing or guarantee delivery? No. DKIM is one part of email authentication, not a delivery guarantee or a complete policy against impersonation.

Related help

For separate WordPress-site assistance, see WordPress support. For related hosting and WHM/cPanel guidance, see WHM/cPanel articles and hosting articles. These resources are related help; they are not a substitute for the provider that controls the DKIM signer and DNS instructions.

Sources: DKIM protocol, RFC 6376 and cPanel Email Deliverability documentation.