DKIM records for 16 email providers
The selectors each service uses, whether you publish a CNAME or a TXT key, and who holds the private key. Each provider's page has the exact record names, where to turn signing on, and links to the provider's own documentation.
Provider DKIM selectors at a glance
With a CNAME, the provider keeps the key and can rotate it without you touching DNS. With a TXT record, the public key sits in your zone, and a new key means a new record. Selectors shown with angle brackets are generated per account: copy the exact names from the provider's admin screen.
Mailbox providers
| Provider | Record type | Selectors | Key managed by |
|---|---|---|---|
| Microsoft 365 | CNAME | selector1, selector2 |
Provider (CNAME delegation) |
| Google Workspace | TXT | google |
Provider (you publish its key) |
| Zoho Mail | TXT | you choose (e.g. zoho) |
Provider (you publish its key) |
| GoDaddy | CNAME | secureserver1, secureserver2 |
Provider (CNAME delegation) |
| Fastmail | CNAME | fm1, fm2, fm3 |
Provider (CNAME delegation) |
| Proton Mail | CNAME | protonmail, protonmail2, protonmail3 |
Provider (CNAME delegation) |
Transactional sending services
| Provider | Record type | Selectors | Key managed by |
|---|---|---|---|
| Amazon SES | CNAME or TXT | <token1>, <token2>, <token3> (Easy DKIM), your own (BYODKIM) |
Provider (CNAME delegation) |
| SendGrid | CNAME or TXT | s1, s2 |
Provider (CNAME delegation) |
| Mailgun | TXT or CNAME | assigned by Mailgun (e.g. pic, krs, smtp), pdk1, pdk2 (Automatic Sender Security) |
Provider (TXT key or CNAMEs) |
| Postmark | TXT | <timestamp>pm (e.g. 20131031155228pm) |
Provider (you publish its key) |
Marketing platforms
| Provider | Record type | Selectors | Key managed by |
|---|---|---|---|
| Mailchimp | CNAME | k2 and a second CNAME (Marketing), mte1, mte2 (Transactional) |
Provider (CNAME delegation) |
| Brevo | TXT or CNAME | mail (TXT), 2 CNAMEs from your account |
Provider (TXT key or CNAMEs) |
| HubSpot | CNAME | hs1-<number>, hs2-<number> |
Provider (CNAME delegation) |
| Klaviyo | CNAME | km1, km2 (marketing), kt1, kt2 (transactional), ks1, ks2 (service) |
Provider (CNAME delegation) |
CRM and help desks
| Provider | Record type | Selectors | Key managed by |
|---|---|---|---|
| Salesforce | CNAME | you choose two (e.g. example-sf-a, example-sf-b) |
Provider (CNAME delegation) |
| Zendesk | CNAME | zendesk1, zendesk2 |
Provider (CNAME delegation) |
Running several senders on one domain
Unlike SPF, DKIM has no single record to merge. Each service signs with its own selector, so its key lives at its own name, <selector>._domainkey.yourdomain.com (RFC 6376 section 3.6.2.1). Google's google key and Microsoft's selector1 can sit side by side during a migration.
Two things do clash. If two services both default to the same selector name, only one key can live there, so pick a different selector on the service that lets you choose. And a CNAME can't share its name with any other record, so delete an old TXT key before you add a CNAME with the same host.
For DMARC, what counts is the d= domain in each signature. Under relaxed alignment, the default, it has to share your From domain's organizational domain (so a parent domain or a subdomain both count) (RFC 9989 section 4.4). Services that sign with their own domain until you authenticate yours pass DKIM but fail DMARC alignment.
Check a DKIM key
Enter your domain and a selector from the table to see the live key and its length. Leave the selector empty to try common ones. Reads public DNS only.
Frequently asked questions
Do I combine DKIM records from several providers like SPF includes?
No. Each service publishes its key under its own selector name, so the records sit side by side and nothing is merged. Just check that two services don't want the same selector, such as s1, at the same domain.
Is a CNAME or a TXT DKIM record better?
A CNAME lets the provider keep and rotate the private key without you editing DNS, which is why most services now use one. A TXT record puts the public key in your zone, so each new key is a DNS change you make. Use whichever the provider offers.
Why does DKIM pass but DMARC fail for mail from my email provider?
The signature is probably for the provider's own domain, not yours, so it isn't aligned with your From address. Complete the provider's domain authentication so it signs with d= your domain, then check a message's headers.
Related guides
How to find a domain's DKIM selector, and check its key
Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.
8 min read SPF, DKIM & DMARCHow to rotate DKIM keys without breaking email
How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.
9 min read SPF, DKIM & DMARCDKIM "body hash did not verify" and other DKIM failures: causes and fixes
Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.
9 min readValues checked against each provider's documentation on . Sources are listed on each provider's page. Looking for SPF instead? See SPF records by provider.