Setup & Records

Smart DKIM: let DMARCS host your DKIM keys

DKIM works by publishing a public key in your DNS so receivers can check the signature on your mail. Smart DKIM hosts that DNS record for you. You add one CNAME, and after that DMARCS handles every key change.

Where to find it

Setup & Records → Smart DKIM

Time needed

10 minutes

You will need

Access to your DNS, and to your mail server's DKIM signing settings if you are generating a new key

A few words you'll see

• Selector: a short name that identifies which key signed a message, for example default or google. One domain can have several.
• Public key: the part that goes in DNS. Anyone can see it.
• Private key: the part your mail server uses to sign outgoing mail. Keep it secret; anyone who has it can send mail that passes as you.

Option A: generate a new key pair

Use this if you run your own mail server, or your provider lets you paste in a private key.

1. Pick the domain and name the selector

   Letters and numbers only, for example default. Then click Generate Keypair. DMARCS creates a 2048-bit RSA key on the spot.

2. Save the private key

   The private key is shown once, in full, with a copy button. Put it in your mail server's DKIM signing configuration now. Tick the checkbox confirming you've stored it safely; the save button stays disabled until you do.

   DMARCS keeps an encrypted copy, so if you lose it you can retrieve it again later from the record's Reveal action. Treat it like a password either way.
3. Save & Publish

   Continue to the CNAME step below.

Option B: import a key your provider already gave you

Use this if Google Workspace, Microsoft 365, SendGrid or another provider already generated your DKIM key and you just want DMARCS to host the DNS side.

1. Switch to Import Existing
2. Enter the selector name your provider gave you

   It must match exactly; the provider signs with this name.

3. Paste the public key

   Only the base64 text. Leave out the -----BEGIN----- and -----END----- lines if your provider included them.

4. Save & Publish

Add the CNAME (both options)

After saving, DMARCS shows you one CNAME record to add at your DNS provider. It looks like this, with your own selector and domain filled in:

Copy the exact values from the app rather than from this page. DMARCS hosts the real TXT record at that target. Once the CNAME is live, that is the last DNS change you will make for this selector, even when the key underneath changes.

Rotating a key later

Don't overwrite the existing selector. Add a second one (for example default2), publish its CNAME, switch your mail server to sign with the new selector, and only then delete the old record from DMARCS. Deleting it retracts the hosted DNS entry.