Setting Up DKIM for Common ESPs

How custom DKIM domain signing works

By default, most email platforms sign outgoing mail with their own DKIM key — not yours. The signature is valid, but the signing domain (d=) is the platform's domain, not your From: domain. That means DMARC alignment fails on DKIM.

Custom domain signing works via DNS CNAME records. The platform generates a key pair; you publish a CNAME in your DNS that points to their infrastructure. They sign mail with a selector under your domain. DKIM alignment passes.

The general pattern for every platform is the same:

1. Go to the platform's email authentication or sending domain settings.
2. Add or verify your sending domain.
3. The platform gives you one or more DNS records to publish (TXT or CNAME).
4. Publish those records at your DNS registrar or DNS host.
5. Return to the platform and verify. DKIM will be activated once verification passes.

Google Workspace

In the Google Admin console: Apps → Google Workspace → Gmail → Authenticate email.

1. Select your domain from the dropdown.
2. Click Generate new record. Choose 2048-bit key length.
3. Google provides a TXT record for google._domainkey.yourdomain.com.
4. Publish that TXT record in your DNS.
5. Return to Admin console and click Start authentication. It may take up to 48 hours to propagate.

Google Workspace generates a TXT record, not a CNAME. The value is a long public key string.

Microsoft 365

In the Microsoft 365 Defender portal: Email & Collaboration → Policies & Rules → Threat policies → Email authentication settings → DKIM.

1. Select your domain.
2. Microsoft shows two CNAME records to publish: selector1._domainkey.yourdomain.com and selector2._domainkey.yourdomain.com.
3. Publish both CNAME records in your DNS.
4. Return to the portal and toggle DKIM signing to enabled.

Microsoft uses two selectors to support key rotation without downtime. Both must be published before enabling.

SendGrid

In SendGrid: Settings → Sender Authentication → Domain Authentication.

1. Click Authenticate Your Domain.
2. Enter your domain and follow the prompts.
3. SendGrid provides two CNAME records: one for DKIM, one for tracking/return-path.
4. Publish both CNAMEs in your DNS.
5. Return to SendGrid and click Verify.

Publishing the return-path CNAME also configures SPF alignment for SendGrid, which is a bonus.

Mailchimp

In Mailchimp: Account → Settings → Domains.

1. Click Add & Verify Domain and enter your sending domain.
2. Mailchimp sends a verification email or provides DNS records to publish.
3. Publish the DKIM CNAME records Mailchimp provides.
4. Return to Mailchimp and verify.

Mailchimp also offers an option to authenticate the domain via DNS for both DKIM and custom return-path. Use both for full alignment.

Mailgun

In Mailgun: Sending → Domains → Add New Domain.

1. Add your domain. Mailgun recommends using a subdomain like mg.yourdomain.com for sending, which keeps authentication clean.
2. Mailgun provides TXT records for SPF and DKIM, and a CNAME for tracking.
3. Publish all provided records in your DNS.
4. In Mailgun, click Verify DNS Settings.

After setup: verify alignment in your DMARC reports

After configuring DKIM on any platform, wait 24–48 hours for DNS to propagate and for reports to reflect the change. In your DMARC aggregate reports, you should see the sender's source IP now showing DKIM pass with alignment to your domain.

If DKIM still shows as failing alignment after 48 hours, verify the DNS records published correctly and that the platform shows the domain as verified and DKIM as active.