Hosted DKIM

Included with Email Authentication Plus ($12/month) and above.

1. What This Feature Does

Every message your domain sends should carry a DKIM signature. The service that sends the message signs it with a private key; the receiving server checks the signature against the public key published under your domain, at <selector>._domainkey.<your domain>. If that public key is missing, wrong or weak, the signature fails and DMARC can reject your mail.

Hosted DKIM keeps those public keys published, checked and watched, for three kinds of key:

• Keys your sending services give you — Google Workspace, Microsoft 365, SendGrid, Amazon SES and the rest. A service hands out its key either as a value (a TXT record) or as a host name to point at (a CNAME).
• Keys for your own mail server, generated in your browser. The private key never leaves your browser; CertaDNS receives only the public key.
• Keys CertaDNS generated before 30 September 2026, if you have any. They are listed separately so they can be wound down.

CertaDNS does not sign your mail and never holds a private key that can sign as your domain.

2. When You Should Use It

• Several services send mail as your domain and you want one list of every DKIM key, with which ones are actually signing.
• A service gives you a key value that it replaces from time to time. With Hosted DKIM you paste the new value into CertaDNS instead of editing DNS.
• You run your own mail server (Postfix with OpenDKIM, Exim, Exchange on-premises) and need a key generated and published.
• You want to hear when a key stops resolving, is weaker than 2048 bits, is left in test mode, stops signing, or when a key you have not listed starts signing your mail.
• You would rather add new sending services without a DNS change each time: delegate _domainkey to CertaDNS once.

3. When You Should Not Use It

• Domains that never send mail. They need no DKIM key. Publish a strict DMARC policy with the DMARC Policy Wizard instead.
• You are on the Free tier. Hosted DKIM starts at Plus.

4. Prerequisites

• Email Authentication Plus or above.
• The domain added under Email Authentication > Add Domains. Managed DNS is not required.
• If your domain's DNS is hosted elsewhere: access to add either one CNAME per selector, or three NS records once to delegate _domainkey. If the domain is on Managed DNS, CertaDNS publishes everything in your zone and you add nothing.
• To generate a key for your own mail server: a current browser over HTTPS, and access to install the private key on the server.

5. How It Works (Brief)

Where each key is published depends on where your DNS lives and how the service hands out its key:

Checking. Every key is checked against public DNS every 6 hours, and whenever you click Verify DNS. For a key value, the key at your selector must match the one you added. For a host name, it must match whatever the service publishes behind that name right now — so when the service rotates its own key, the check keeps passing.

Signing evidence. CertaDNS reads which DKIM selectors signed your mail in the DMARC aggregate reports it receives for your domain. That is what powers Find keys, the message counts on each key, the stopped signing warning and the unlisted key alert.

6. How to Use It

Everything below is in Email Authentication > Hosted Services > Hosted DKIM.

Add a key from a sending service

1. In your sending service's DKIM setup, note the selector and whether it gives you a value (TXT) or a host name (CNAME). Microsoft 365 and SendGrid give two host names and Amazon SES gives three: add each one as its own key.
2. Click Add a key. Choose the domain, optionally name the service, enter the selector, choose Key value (TXT) or Host name (CNAME), and paste what the service gave you.
3. Click Add key. The key appears with the DNS change it still needs, if any — for example CNAME google._domainkey.example.com → ….
4. Make that change at your DNS host, then click Verify DNS. The key turns Active.

Find keys you already use

1. Choose a domain in Find keys on… and click Find.
2. Selectors seen signing in your DMARC reports come first, with how many messages they signed and when they were last seen. Selectors found in DNS follow.
3. Click Add on any you use. A selector seen in reports but with no key in DNS cannot be added until the key is published.

Generate a key for your own mail server

1. Click Generate a key for your mail server. Choose the domain, a selector (for example mail) and a key size, then click Generate.
2. The key pair is created in your browser. Copy or Download the private key — this is the only copy, and it is discarded if you close the panel or leave the page. The OpenDKIM configuration section shows the KeyTable and SigningTable lines for it.
3. Tick I have saved the private key and click Publish the public key. Only the public key is sent to CertaDNS.
4. Install the private key on your mail server, configure it to sign with the selector you chose, add any CNAME the key card shows, then click Verify DNS.

Replace a key a service has changed

Click Replace key (or Change target for a host name), paste the new value, and click Save. The new key is published under the same selector and shows Pending DNS until it verifies. No DNS change is needed on your side.

Rotate a key for your own mail server

1. On the key, click Rotate. A new pair is generated under the alternate selector — mail becomes mail-b, and the next rotation returns to mail.
2. Save and publish it as above, install the new private key, and switch your server to the new selector.
3. Keep the old key published for a couple of days — an overlap period, so mail already in transit still verifies — then click Remove on it. If you forget, the old key is flagged once it has not signed anything for 30 days.

Delegate _domainkey to CertaDNS

For a domain whose DNS is hosted elsewhere. After this, adding, replacing or removing a key needs no DNS change.

1. In _domainkey delegation, choose the domain and click Set up. CertaDNS creates the zone holding every key the domain has.
2. Add the three NS records shown at your DNS host, for the name _domainkey.<your domain>. Your existing CNAMEs keep working until you do.
3. Click Check. The delegation shows Delegated once your DNS host lists exactly those three name servers. You can then delete the per-selector CNAMEs; they are no longer consulted.

To undo it, put back a CNAME for each selector (each key shows the one it needs), delete the NS records, click Check, then Remove.

Remove a key

Click Remove and confirm. A key CertaDNS publishes is withdrawn from DNS — mail still signed with it will fail DKIM, so remove it only after the service or server has stopped using it. For a service's host name on a domain with per-selector CNAMEs, CertaDNS simply stops checking it; your DNS is not changed.

7. Inputs and Settings

8. Outputs and Results

Each key shows

• The selector and domain, the service name, and — when your reports have it — how many messages the key signed and when it was last seen.
• The key type and size (for example RSA 2048), and Revoked or Test mode when they apply. Keys under 2048 bits are highlighted.
• Its status: Active (resolving correctly), Pending DNS (not verified yet), or Not resolving (it was working and has stopped), with the reason.
• The DNS change it still needs, if any.

Each delegation shows

• Waiting for NS records — the zone exists; your DNS host does not delegate to it yet.
• Delegated — every key on the domain is served through the delegation.
• Needs attention — your DNS host delegates, but lists only some of the three name servers, or others as well. The detail names which.

Alerts

Which alerts a domain sends is set under Email Authentication > Manage Domains, in the domain's Alert monitoring panel; the recommended setting covers all of these. How they reach you — in the dashboard, by email — is in Settings > Notifications, under Email authentication.

• A key that was working stops resolving, or is revoked.
• A delegation stops working.
• A key is under 2048 bits or in test mode, or a key value has stopped signing.
• A selector you have not listed signed your mail in the last 7 days.

9. How to Interpret Results

Normal

• Every key Active, with recent message counts.
• One of a service's host names showing no recent mail. Microsoft 365, SendGrid and Mailgun alternate between two selectors and sign with one at a time.

Worth investigating

• Not resolving — the CNAME or NS records at your DNS host were changed or removed, or the service withdrew its key.
• Stopped signing on a key value — usually the old key left behind after the service or your server moved to a new one. Remove it once you are sure.
• An unlisted key signing your mail — a service you use that is not in the list yet (add it), or one you do not recognise. Find out who holds its private key.
• Test mode — receivers are told to ignore failed signatures. Usually left on after setup.

Common mistakes

• Reading Active as "my mail is signed". Active means the public key is published and correct. Whether mail is signed depends on the service or server; the message counts and DMARC Reporting show that.
• Verifying straight after a DNS change. Resolvers can cache the old answer for up to an hour. Verify again later.

10. Common Issues and Explanations

"That is a private key. Paste the DNS record value…"

You pasted the key the service or server signs with. Paste the public DNS record instead — it starts with v=DKIM1 or contains p=. The private key is not stored or shown back.

"That record has no p= (public key) tag" or "… is not a DKIM key-record tag"

What you pasted is not a DKIM key record — often an SPF or verification record copied from the wrong line.

"… does not serve a DKIM key yet"

For a host name: finish the DKIM step in the sending service first. Services publish the key behind the host name before you point at it.

"Selector '…' on … is already …"

Another key on the domain uses that selector. Remove it first, or use the selector the service gave you.

"… serves a different key"

Your selector resolves, but not to the expected key. Check that the CNAME points where the key card says, or — for a host name — at the service's host name.

"… is on Managed DNS, so its DKIM keys are already published in its own zone"

Delegation is only for domains whose DNS is hosted elsewhere. On Managed DNS there is nothing to delegate.

"This browser cannot generate keys here"

Key generation needs a current browser over HTTPS. Alternatively, run opendkim-genkey -b 2048 -s mail -d example.com on your mail server and add the resulting public key with Add a key.

"CertaDNS no longer generates DKIM private keys"

Returned by the older key-generation endpoint. Generate the key in your browser as described above, or add the key your sending service gives you.

11. Limits and Constraints

12. Related Features

• DMARC Reporting — which of your mail passed DKIM, and which services sent it.
• DMARC Policy Wizard — moving to enforcement once your keys are in place.
• SPF Flattening — the other half of DMARC alignment.
• BIMI — needs DMARC at enforcement, which needs working DKIM.

13. Updates and Behavior Changes

• 30 September 2026. Hosted DKIM now hosts and checks the keys your sending services issue; finds keys from your DMARC reports; supports delegating _domainkey; checks every key every 6 hours with alerts; and generates keys for your own mail server in your browser. CertaDNS stopped generating private keys on its servers, and the rotation settings described in earlier versions of this article were never available. Keys generated before this date are listed under Keys generated by CertaDNS, where they can be verified, archived, and any rotation in progress finished or cancelled.
• September 2026. Hosted DKIM moved from an add-on to the Plus tier.