What a DKIM CNAME Record Is (and When to Use One)

DKIM signs your outgoing email. Receivers look up a public key at a name like selector._domainkey.yourdomain.com to check the signature. That key lives in a TXT record. A CNAME does not hold the key itself. It points the lookup to a hostname where the key lives.

Two ways to publish a DKIM key

TXT record (you hold the key). You paste the full public key into your own DNS. You are responsible for rotating it. Google Workspace works this way.

CNAME (your provider holds the key). You add an alias. The provider publishes the key at its own hostname and rotates it when needed. You do not touch DNS again to change keys. SendGrid, Amazon SES, Mailchimp, Klaviyo, and Microsoft 365 use this method.

Neither method is more secure. The same key signs the mail either way. The difference is who manages it.

What the CNAME looks like

Your provider gives you a host and a target. For example:

s1._domainkey.yourdomain.com.   CNAME   s1.domainkey.u123.wl.sendgrid.net.
s2._domainkey.yourdomain.com.   CNAME   s2.domainkey.u123.wl.sendgrid.net.

The host is the name you create at your DNS host. The target is the hostname your provider gives you.

How to add it

1. Turn on DKIM in your sending platform's domain settings. Copy each CNAME pair exactly as shown.
2. At your DNS host, create a CNAME record. Put the host in the name field and the target in the value field.
3. If your DNS host auto-adds your domain, enter only the part before .yourdomain.com (for example s1._domainkey).
4. Turn off any proxy on the record. Cloudflare's orange cloud breaks a CNAME delegation. Use DNS-only (grey cloud).
5. Wait for DNS to update, then ask your provider to verify the domain.

Check it

dig +short s1._domainkey.yourdomain.com CNAME
dig +short s1._domainkey.yourdomain.com TXT

The first command should return your provider's target. The second should return a value starting with v=DKIM1 and containing p=.

Rules to know

• A name can have a CNAME or a TXT record, not both. If you are switching from a TXT key to a CNAME, delete the TXT first.
• Do not put a DKIM CNAME on your root domain.
• If one of the provider's selectors is missing, some mail will fail intermittently. Add all the pairs the provider gives you.

If your provider gave you a TXT value instead of a CNAME, use that value as a TXT record at the same host.