How do I find my DKIM record for my email?

Your DKIM record (DomainKeys Identified Mail) is a digital signature that proves emails sent from your domain really came from you. You get it from your email provider, such as Google Workspace or Microsoft 365, then add it to your domain's DNS records (the settings that tell the internet where your website and email live). This guide shows you where to find your DKIM key, email authentication record or DKIM signature for each major provider, and how to add it.

What is a DKIM record and why do I need one?

Without DKIM (and its partners, SPF and DMARC), your emails are more likely to land in spam or be rejected. Google, Yahoo and Microsoft now require email authentication, so if you're sending emails to Outlook or Hotmail addresses and they're bouncing, a missing DKIM record is a common cause.

There are three parts to setting it up:

1. Get your DKIM record from your email provider.
2. Add the record to your domain name provider.
3. Turn DKIM on back in your email provider.

Not sure who your email provider is?

Your DKIM record always comes from the company that sends your email, not from your website. If you're not sure who that is, try one of these:

• Check where you log in to read email. If it's Gmail with your business address, it's Google Workspace. If it's Outlook or outlook.office.com, it's usually Microsoft 365.
• Look for the invoice. Search your inbox or bank statements for Google Workspace, Microsoft 365, Zoho, GoDaddy, Crazy Domains, Fastmail or Proton.
• Check your MX records (the DNS records that tell the internet where to deliver your email). In your Rocketspark Dashboard, go to Domain Names and click your domain. The MX record value tells you the provider:

Ask whoever set up your email. This could be your IT person, web designer or a previous agency.

💡 Sending newsletters through Mailchimp or MailerLite? They need their own DKIM records too, on top of your normal email provider's.

Step 1: Get your DKIM record from your email provider

Find your provider below and follow the steps. Each one gives you a Name (also called Host) and a Value to copy. Keep this tab open, you'll need both in Step 2.

Google Workspace (Gmail)

1. Sign in to the Google Admin console (admin.google.com) with an admin account.
2. Go to Apps > Google Workspace > Gmail > Authenticate email.
3. Choose your domain from the Selected domain list.
4. Click Generate new record. Leave the key length at 1048 and the prefix as google, then click Generate.
5. Copy the record. It's a TXT record with the name google._domainkey and a long value starting with v=DKIM1;.

Microsoft 365 (Outlook)

1. Sign in to the Microsoft Defender portal (security.microsoft.com/authentication) with an admin account.
2. Go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then select the DKIM tab.
3. Click your domain. The panel that opens shows two CNAME records under Publish CNAMEs.
4. Copy both. The names are selector1._domainkey and selector2._domainkey. Microsoft gives you the values.

⚠ You need to add both CNAME records, even though Microsoft only uses one at a time.

Zoho Mail

1. Sign in to the Zoho Mail Admin Console (mailadmin.zoho.com).
2. Go to Domains, choose your domain, then open the Email Configuration tab and click DKIM.
3. Click Add, enter a selector name (for example zoho), choose 2048 bits, then click Add.
4. Copy the TXT record. The name is your selector plus ._domainkey (for example zoho._domainkey).

GoDaddy Professional Email

1. Sign in to your GoDaddy Email & Office Dashboard.
2. Under Users, click Manage next to your email address, then click Help me fix this or Set mail destination.
3. Copy the two DKIM CNAME records. The names are secureserver1._domainkey and secureserver2._domainkey.

Crazy Domains (Titan Email)

1. Sign in to your Crazy Domains account and open Titan Email Manager.
2. Click Email Reputation, then click ADD under DKIM.
3. Copy the TXT record. The name looks like titan2._domainkey and the value starts with v=DKIM1;.

Fastmail

Fastmail uses three CNAME records. You don't need to generate anything, add these and swap in your own domain:

Proton Mail

1. Sign in to Proton Mail and go to Settings > All settings > Organization > Domain names.
2. Click Review next to your domain, then select the DKIM tab.
3. Copy all three CNAME records.

Mailchimp (newsletters)

1. In Mailchimp, click your profile icon, then Account & billing > Domains.
2. Click Start authentication next to your domain.
3. Choose Or manually authenticate your domain, pick Other as your provider, then click Next.
4. Copy the two CNAME records (CNAME 1 and CNAME 2), and the DMARC TXT record if shown.

MailerLite (newsletters)

1. In MailerLite, go to Account settings > Domains.
2. Click + Add sending domain, enter your email address and click Save.
3. Choose Authenticate manually.
4. Copy the DKIM CNAME record, plus the SPF and verification TXT records MailerLite shows you.

Using a different provider?

Search your provider's help centre for "DKIM". The setting is usually under admin, domain or email authentication settings. If you can't find it, contact your email provider and ask for your DKIM record.

Step 2: Add the DKIM record to your domain name provider

Next, add the record where your domain's DNS is managed. This is your domain name provider (also called your registrar or DNS host). If your domain is with Rocketspark, follow the Rocketspark steps. If it's somewhere else, like GoDaddy, Crazy Domains, Cloudflare or Domainz, follow the steps for other providers.

If your domain is with Rocketspark

1. Log in to your Rocketspark Dashboard.
2. Click Domain Names in the left-hand menu.
3. Click your domain name, or the pencil icon next to it.
4. Click Add New Record.
5. Choose the Type your email provider gave you (TXT or CNAME).
6. In Name, paste the name only, without your domain on the end. For example, enter google._domainkey, not google._domainkey.yourdomain.com.
7. In Value, paste the full value exactly as your provider shows it.
8. Save the record. If your provider gave you more than one record, repeat these steps for each one.

You can check out our guide here: How do I add/remove DNS records through Rocketspark?

If your domain is with another provider

1. Log in to the account where you bought or manage your domain.
2. Find the DNS settings. This is usually called DNS, Manage DNS, DNS records or Zone editor.
3. Click to add a new record and choose TXT or CNAME, matching what your email provider gave you.
4. Enter the Name (sometimes called Host). Most providers add your domain automatically, so enter only the first part, like selector1._domainkey.
5. Paste the Value (sometimes called Points to, Target or Content).
6. Leave TTL as the default and save.

💡 Not sure where your domain is managed? Search your domain on a WHOIS lookup site such as whois.com. The Registrar line shows who your domain is registered with, and the Name servers show who manages your DNS.

Step 3: Turn DKIM on

Once the record is added, go back to your email provider and switch DKIM on. DNS changes usually take 15 to 30 minutes, but can take up to 48 hours.

• Google Workspace: go back to Authenticate email, select your domain and click Start authentication.
• Microsoft 365: on the DKIM tab, switch the toggle for your domain to Enabled.
• Zoho Mail: click Verify next to your selector, then enable DKIM.
• Mailchimp and MailerLite: click verify or Check DNS records in the Domains area.
• GoDaddy, Crazy Domains, Fastmail and Proton: these check the record automatically once it's live.

If you get an error, wait an hour and try again. It usually means the record hasn't finished updating yet.

Tips and things to watch out for

• Copy and paste the value. Typing it out by hand almost always introduces a mistake.
• Don't add your domain to the end of the Name if your provider adds it for you, or you'll end up with yourdomain.com.yourdomain.com.
• Each provider uses its own name (selector), so adding a new DKIM record won't replace an existing one from another service.
• Microsoft, GoDaddy, Fastmail and Proton give you more than one record. Add them all.

Frequently asked questions

Where do I find my DKIM key? In your email provider's admin settings, not in Rocketspark. See Step 1 for where it lives in each provider.

Can Rocketspark generate my DKIM record for me? No, only your email provider can create it. Once you have it, you can add it to your Rocketspark DNS yourself using Step 2.

Why are my emails to Outlook or Hotmail bouncing? Microsoft now rejects or junks email from domains without proper authentication. Setting up DKIM, along with SPF, usually fixes this.

Is DKIM a TXT or CNAME record? It depends on the provider. Google, Zoho and Crazy Domains use TXT. Microsoft, GoDaddy, Fastmail, Proton, Mailchimp and MailerLite use CNAME.

How do I know if DKIM is working? Your email provider will show the status as authenticated or enabled. You can also send an email to a Gmail address, open it, click the three dots and choose Show original. Look for DKIM: PASS.

I use Mailchimp and Google Workspace. Do I need two DKIM records? Yes. Each service that sends email for your domain needs its own DKIM record.

Need more help?

If you're still stuck, flick us a message at support@rocketspark.com or give us a call on 0800 762 538 (9am to 4pm, Monday to Friday). We can't generate DKIM records for you, but we're happy to check the record has been added to your Rocketspark DNS correctly.