A DKIM (DomainKeys Identified Mail) record is a TXT record you publish in your DNS zone that holds the public half of a cryptographic key pair. Your mail server signs each outgoing message with the matching private key, and receiving servers look up your DKIM record to verify that signature. Adding it improves deliverability and helps prove your mail was not altered in transit. This guide shows how to generate and publish a DKIM record in cPanel, then confirm it is live.
How DKIM works
DKIM does not encrypt your mail. It attaches a signature header that a receiving server can check against your published public key. If the signature validates, the message is confirmed to come from a server authorized to sign for your domain, and its signed content has not been tampered with. DKIM is one of three related standards, alongside SPF and DMARC, that together build sender reputation and reduce spoofing.
Sending server signs with private key Receiving server reads signature DNS TXT record public key email lookupGenerate the DKIM key in cPanel
On most cPanel servers the fastest path is to let the control panel create the key pair and publish the record for you. It writes the private key into the mail configuration and adds the public record to your zone automatically.
- Open cPanel and go to the Email section.
- Click Email Deliverability.
- Find your domain in the list and click Manage.
- In the DKIM panel, if a record is missing or invalid, click Repair. cPanel generates the key pair and installs the TXT record in the local zone.
If your DNS is hosted with an outside provider rather than on this server, cPanel will show you the exact record to copy. In that case, add it manually at your DNS host using the values below.
Publishing the record manually
A DKIM record lives at a subdomain built from a selector plus the fixed label _domainkey. The selector is a label you choose (cPanel commonly uses default) so you can rotate keys later without collisions. The host name looks like this:
default._domainkey.yourdomain.comThe record type is TXT and the value is a semicolon separated list of tags. A typical value looks like:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...your-public-key...AQABThe tags mean: v is the DKIM version, k is the key type (rsa), and p is the base64 public key itself. To add it in cPanel Zone Editor:
- Open cPanel and go to the Domains section, then click Zone Editor.
- Click Manage next to your domain.
- Choose Add Record and set the type to
TXT. - Enter the name as
default._domainkey(the zone appends your domain). - Paste the full
v=DKIM1; k=rsa; p=...string into the value field and save.
Because the public key is long, some DNS interfaces split it into quoted strings. That is normal, and resolvers reassemble the parts into one value.
Verify it is working
DNS changes take time to propagate, often up to a few hours depending on the TTL. Once live, confirm the record resolves:
dig +short TXT default._domainkey.yourdomain.comYou should see the v=DKIM1 value returned. After that, send a test message to an address you control and inspect the headers for an Authentication-Results line showing dkim=pass. Pair DKIM with a correct SPF record and a DMARC policy for the strongest deliverability. On a dedicated Class C IP, a clean signing setup keeps your sending reputation isolated from other senders, which is one reason SEO focused sites value IP separated hosting.
For related record setup, see our other guides in the DNS and IP management hub, or reach our team through contact us if cPanel reports a record it cannot repair. The full DKIM specification is defined in RFC 6376.
