Activating a DKIM key

You activate DKIM in three moves: have a key created in the 2Mail dashboard, put the record you are shown there into the DNS of your domain, and switch on signing once the check succeeds. The name of that record consists of a selector, the _domainkey part and your domain. The most common mistake: the DNS panel appends your domain to the name a second time by itself, and then nobody can find the record.

What DKIM does and what a selector is

DKIM puts a digital signature on every message that leaves through 2Mail. The receiving server checks that signature against a public key in the DNS of your domain. The private half of the key stays on our servers; you never have to enter it anywhere.

The selector is the label that says which key was used. It is included in the signature of every message, and the recipient looks up the key under the selector, followed by ._domainkey and your domain. Thanks to selectors a domain can have several keys at once: one per service that sends on your behalf, and temporarily two while you replace a key. Unlike with SPF, you therefore do not merge anything. The key of your office mail or newsletter tool simply stays in place, and the 2Mail key sits alongside it.

Always a TXT record

The DKIM record for 2Mail is always a TXT record. It contains the public key itself: a long value that starts with v=DKIM1. The 2Mail dashboard shows the name and the value, ready to copy. With other sending services you will sometimes come across a CNAME record: it contains no key, but points to a record that the service manages itself. For 2Mail you do not create a CNAME. On top of that, a single name can never hold a CNAME and another record at the same time.

Activating the key in seven steps

1. Open your sending domain in the 2Mail dashboard and have a DKIM key created under authentication. You are shown the name of the record (prefixed with the selector), the type and the value.
2. Go to the DNS management of the party that runs the nameservers for your domain. That is not necessarily where you bought the domain.
3. Create a record of type TXT.
4. As the name, enter only the part before your domain: the selector, a dot and _domainkey. Virtually every panel appends the domain itself.
5. Paste the value literally, without adding spaces or line breaks.
6. Save, go back to the dashboard and let 2Mail check the record. Once that succeeds, switch on signing.
7. Send a test message to an external address and look at the headers: the authentication results should show dkim=pass, together with your own domain.

Why a long key sometimes has to be split

A single string in a TXT record may contain at most 255 characters. A 2048-bit key, the usual length today, is longer than that. Such a value is therefore stored as several strings within the same record; the recipient joins them back together. Most panels do this for you without you noticing. If your panel refuses the value because it is too long, cut it into two pieces yourself, put each piece between double quotation marks and separate them with a single space, still within one record. Never turn them into two separate records, and make sure no character is lost where you cut.

Where to add the record, per DNS provider

The pitfall is the same everywhere: the panel automatically appends your domain to the name. If you type the full name including your domain, the record ends up one level too deep. So enter only the part before your domain, unless the panel explicitly asks for the full name.

• Cloudflare — select your domain, open DNS and the records, and add a record with the part before your domain as its name. The proxy toggle (the orange cloud) does not exist for TXT records; there is nothing to do there.
• Combell — in the control panel under your domain name, in the DNS management. TXT records have their own section there.
• one.com — in the DNS settings, under the DNS records. The panel already shows your domain after the name field: type only the front part.
• TransIP — in the DNS section of your domain, add a line with the part before your domain as its name. Do not forget to save at the bottom.
• OVHcloud — in the DNS zone tab, add an entry of type TXT; the subdomain field gets the front part of the name.
• GoDaddy — in the DNS management of the domain, add a new record; the name field gets only the part before your domain.
• Microsoft 365 — if the DNS of your domain is hosted by Microsoft itself, add a custom DNS record for your domain in the admin centre. If you already see the records selector1 and selector2 under _domainkey there, leave them alone: those are the Microsoft keys for mail that leaves through Exchange Online. The 2Mail record has its own selector and sits alongside them.

Checking

The check in the dashboard is the reference. If you want to see for yourself what the outside world sees, enter your domain and the selector from the dashboard in the free SPF, DKIM and DMARC checker. A new record is usually visible within the hour; a changed record follows the previous TTL.

If the check keeps failing

1. Look at how the name really appears in the panel. If it ends in your domain twice, you typed the domain in yourself. Edit the name until only the front part remains.
2. Check the panel. If the nameservers point to another party, the record sits in a place where nobody looks.
3. Check the type. It has to be a TXT record, not a CNAME.
4. Inspect the value. No spaces, no line breaks, not cut off halfway, not spread over two records, and no curly quotation marks from an email or Word document.
5. If the panel refuses the underscore in _domainkey, only your DNS provider can solve that. The underscore is part of the name and must not be dropped.
6. Wait out the TTL before you test again, and test through the dashboard or the checker, not from your own device.

If the check succeeds but a recipient still reports dkim=fail, an intermediate application is altering the message after signing, for instance a signature tool or a disclaimer that is added afterwards.

Several domains

DKIM is per sending domain. If you send from several domains, repeat these steps for each one. A subdomain, for instance a separate domain for newsletters, has its own record.

Replacing the key later

If you want to rotate the key, for example after a staff change or because a security policy requires it, create a new key in the dashboard with a different selector. Put the new record in your DNS and activate the new key as soon as the check succeeds. Then revoke the old key in the dashboard, and only remove the old record a few days later. That keeps messages still in transit valid.

If your SPF record is not right yet, start with adding an SPF record at your DNS provider. After that, switch on DMARC: you draw up the record with the DMARC record generator. The background on all three records is on SPF, DKIM and DMARC.

Frequently asked questions

Do I have to enter the private key anywhere?

No. The private half stays on the 2Mail servers. Only the public part goes into your DNS, and anyone is allowed to see that.

Can the 2Mail key sit next to the one from Microsoft 365 or Google Workspace?

Yes. Each service signs with its own selector, and each selector has its own record. They do not get in each other's way; you do not have to merge or delete anything.

Is DKIM enough without SPF?

For DMARC it is enough that one of the two passes with your own domain, but do not count on that. SPF fails on forwarded mail, and DKIM fails when a message is altered in transit. With both in order, each covers for the other.

How often should I replace the key?

There is no fixed rule. Replace the key when your own security policy requires it, or when you have reason to doubt the current key. By working with a new selector, the switch happens without interruption.

Still stuck?

Send us your domain name and a screenshot of the record in your DNS panel via contact. We check what differs.