DKIM — signing your mail

DKIM (DomainKeys Identified Mail) cryptographically signs each outgoing email so the receiver can verify it was actually sent by your domain and was not altered in transit. It survives forwarding, unlike SPF.

We sign each outgoing campaign with a private key. The matching public key lives in a DNS record on your domain. The receiver fetches the public key, verifies the signature, and confirms two things: the email really came from your domain, and its content has not been tampered with.

How to set DKIM up

1. On the sender-emails settings page, open the domain you want to send from — the wizard shows the DKIM record(s) you need to add. Often these are CNAME records pointing at our key servers, sometimes a long TXT record containing the public key directly.
2. Add the records on a specific subdomain (selector), not on the root. Our records use a selector like "mc._domainkey" so they coexist with any existing DKIM keys you have for other services.
3. Wait for DNS to propagate and re-run verification. Once green, every campaign you send from this domain will be signed automatically.

📘

DKIM survives forwarding

When a recipient forwards your campaign to a colleague, the forwarding mail server is not the original sender and SPF will fail on the new path. DKIM, however, signs the message itself — the signature stays valid through forwards. This is one reason DKIM is now considered the more important of the two.

🚧

DNS records must stay exact

DKIM public keys are long strings — accidentally adding a space, line break, or trailing dot during copy/paste invalidates the record. If verification fails after you added the record, double-check the exact value matches what the wizard shows.

What is a DKIM selector?

A subdomain prefix (like mc._domainkey) where the public key lives. Selectors let multiple DKIM keys coexist on the same domain — one for each service that signs mail on your behalf.

Where exactly does the DKIM record go?

On the selector subdomain shown in the verification wizard — usually as a CNAME pointing at our key servers, sometimes a long TXT record containing the public key directly. The wizard tells you which type and the exact value.

My DKIM verification fails after I added the record — what next?

Wait a bit longer for DNS to propagate (often a few minutes, occasionally hours), then double-check the value exactly matches the wizard. DKIM keys are long; a stray space, newline, or trailing dot invalidates them.

Why is DKIM considered more important than SPF?

DKIM signs the email itself, so the signature survives forwarding. SPF only authorises the sending server — when a recipient forwards your campaign, the forwarding server is different and SPF fails on the new path.

See also

• SPF — authorising senders
• DMARC — tying it together
• What is a campaign