Before you start
- Admin access to each service that sends mail as your domain
- Access to the domain's DNS
Step 1: Understand selectors
A DKIM public key is published as a record at selector._domainkey.yourdomain.com, and each signed message names its selector. Because every sender picks its own selector, a domain can have many DKIM records side by side — unlike SPF, where there must be exactly one.
Step 2: Hosting mailboxes on cPanel
Open Email → Email Deliverability and choose Manage for the domain. cPanel shows whether DKIM is valid and the record it expects, normally at the selector default. If the domain's DNS is on the same server, it can install the record for you; if DNS is elsewhere, copy the name and value it shows into that DNS host.
default._domainkey TXT "v=DKIM1; k=rsa; p=<public key from the panel>"Step 3: Google Workspace
Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit record, publish it as a TXT record at google._domainkey (the default selector), wait for it to resolve, then return and click Start authentication. Google does not sign with your domain until you do.
Step 4: Microsoft 365
In the Microsoft Defender portal, open the DKIM page under the email authentication settings and select the domain. Microsoft asks for two CNAME records, selector1._domainkey and selector2._domainkey; copy the targets exactly as shown, because their format differs between tenants. Once they resolve, enable signing for the domain.
Step 5: Every other sender
Newsletter platforms, CRMs and help desks have a domain authentication section that gives you their own records, usually CNAMEs. Without this, they sign with their own domain, which passes DKIM but does not count for your DMARC.
Step 6: Watch for long keys
A 2048-bit key is longer than the 255 characters one TXT string can hold, so it is stored as several quoted strings that receivers join together. Most panels split it for you. If yours truncates the value instead, the signature fails — check the published record against what the sender gave you.
Step 7: Confirm a real message passes
Send a message to a Gmail address, open it, and choose Show original. You want DKIM: PASS with your own domain. You can also query the key directly.
dig +short TXT default._domainkey.yourdomain.com
The mistake people make
Setting up DKIM for the main mailbox and stopping there. The newsletter and invoicing tools keep signing with their own domains, and they are the first mail to fail once DMARC is enforced.