How do I set up DKIM for a custom email domain?

How does DKIM work?

DKIM lets the sending server sign each message with a private key, and lets any receiver check the signature with a public key published in DNS. The signature sits in a DKIM-Signature header. It carries the signing domain (d=), the selector (s=), the signed headers (h=), a hash of the body (bh=) and the signature itself (b=). RFC 6376, an Internet Standard, defines these tags.

The receiver builds the DNS name from the selector and the domain: selector._domainkey.domain. For the selector fm1 and the domain example.com, it asks for fm1._domainkey.example.com. The answer is a record with the tags v=DKIM1, k=rsa and p= followed by the public key in base64. An empty p= means the key is revoked.

A valid signature proves two things: the message was signed by a system that holds the private key for that domain, and the signed parts did not change in transit. It does not say the message is wanted. That judgement belongs to DMARC, covered in SPF vs DKIM vs DMARC.

Why do providers ask for CNAME records instead of a key?

A CNAME hands the key to the provider: the public key stays at the provider's address and the provider can replace it without asking you to edit DNS. Proton Mail, Fastmail and Mailbox.org all use this pattern. Their records are CNAMEs from your selector name to a host they control, which holds the actual key record.

The benefit is key rotation. RFC 6376 advises publishing new keys under new selectors rather than reusing a selector, and Proton Mail publishes three selectors (protonmail, protonmail2, protonmail3), which gives the provider room to move from one key to the next. The cost for you is trust: you rely on the provider's host to keep answering.

According to Postelva's comparison of 12 November 2026, the three providers whose DKIM records were read on their help pages need 3, 4 and 3 CNAME records, 10 in all, and none asks for a TXT key.

How long should the DKIM key be?

Use a 2048-bit RSA key; 1024 bits is the minimum that RFC 6376 allows for long-lived keys. The standard says signers must use RSA keys of at least 1024 bits, and verifiers must be able to check keys from 512 to 2048 bits. Google's sender guidelines ask for at least 1024 bits and recommend 2048. When the provider creates the key, as with the CNAME setup above, the length is its choice and nothing is left for you to configure.

When you must pick a size yourself, pick 2048. A 2048-bit key is longer than one 255-character string in DNS, so the TXT value is split into several strings, which most DNS editors do on their own. The same editor limit applies to the SPF record described in how to create an SPF record.

Can I use several providers on one domain?

Yes: each provider signs with its own selector, so their DKIM records do not collide. The selector is the reason. Proton uses protonmail, protonmail2 and protonmail3; Fastmail uses fm1, fm2 and fm3; Mailbox.org uses MBO0001 to MBO0004. A newsletter tool that sends in your name adds a selector of its own.

SPF is different: it holds one record for all senders, with a 10-lookup limit. When you leave a provider for good, remove its DKIM records after you have confirmed that the new one signs, so that an abandoned key cannot be used by anyone who gains access to the old account. For the full order of a migration, see how to move email to a new provider without losing mail.

How do I check that DKIM works?

Look the selector up with dig and then send a real message. The command dig CNAME fm1._domainkey.example.com +short should print the provider's target. For a TXT key, ask for TXT instead. The decisive test is a message: the headers of the received copy show whether the receiving server recorded dkim=pass.

If the record is correct and the check still fails, the usual causes are a wrong host name (the domain added twice by the DNS editor), a stale cache, or a message sent before the provider activated signing. The next guide, how to check MX, SPF, DKIM and DMARC records, lists the commands. The Fastmail steps in full are in the Fastmail custom domain guide.