DKIM¶

Use this page to understand and manage DKIM records. DKIM is an email authentication check that lets receiving mail servers verify that a message was signed by an expected mail system for the domain.

DKIM In Plain English¶

Imagine sending a letter in an envelope with a seal that only the sender can create.

• The sending mail server keeps a private key.
• Each outgoing message gets a DKIM signature.
• The matching public key is published in DNS.
• The receiving server uses the public key to check the signature.

If the signature checks out, the receiving server has stronger evidence that the message came from an approved mail system and was not heavily modified in transit.

DKIM does not decide what to do with a failed message by itself. DMARC can use DKIM results, along with SPF results, to decide whether mail should pass, quarantine, or reject.

SPF, DKIM, And DMARC¶

DKIM works best with SPF and DMARC.

Why DKIM Matters¶

• It helps protect the domain from spoofing.
• It improves trust with major mail providers.
• It gives DMARC another signal to evaluate.
• It helps recipients detect mail that was modified after it was sent.

Alice, Bob, And Mallory¶

Alice owns example.com and sends legitimate mail from that domain. Her mail server signs each message with a private DKIM key.

Bob receives one of Alice's messages. Before delivering it, Bob's mail server asks DNS for the matching public DKIM key and checks the signature.

Mallory tries to send Bob a forged message that claims to be from example.com. Because Mallory cannot sign the message with Alice's private key, Bob's mail server can treat the message as suspicious.

How DKIM Works¶

The DKIM check happens after the recipient's mail server receives the message and reads its DKIM-Signature header.

sequenceDiagram
    participant Sender as Your mail server
    participant DNS as Your domain DNS
    participant Recipient as Recipient mail server

    Sender->>Sender: Sign outgoing message with private DKIM key
    Sender->>Recipient: Send email with DKIM-Signature header
    Recipient->>DNS: Look up selector._domainkey.example.com TXT record
    DNS-->>Recipient: Return public DKIM key
    Recipient->>Recipient: Verify the message signature
    alt Signature is valid
        Recipient-->>Recipient: Deliver or trust the message
    else Signature is missing or invalid
        Recipient-->>Recipient: Flag, quarantine, or reject the message
    end

DKIM uses two keys:

• A private key, kept by the sending mail server and used to sign messages.
• A public key, published as a DNS TXT record so receiving servers can verify those signatures.

Enable Or Disable DKIM¶

1. Sign in to the Fused client area.
2. Select Services.
3. Select the green Active status next to the relevant hosting account. MX1 and Mail accounts are listed separately in the client area, so choose the service that handles email for the domain.
4. Select Login to cPanel.
5. Search cPanel for DKIM.
6. Enable or disable DKIM as needed.

What To Check¶

• The DKIM status in cPanel shows as enabled.
• The DKIM TXT record exists at the DNS provider the domain actually uses.
• The selector in the DNS record matches the selector shown in cPanel.
• SPF and DMARC are also configured for broader email authentication coverage.