DKIM record for Campaign Monitor

The DNS records

Copy the TXT value from the Value box in Campaign Monitor exactly. These examples use the sending domain mail.example.com.

DKIM key

Type: TXT · Host: cm._domainkey Copy

<TXT value shown in Campaign Monitor>

Some DNS hosts need the full name, cm._domainkey.mail.example.com.

Existing keys instead (optional)

Type: TXT · Host: <your selector>._domainkey Copy

v=DKIM1; k=rsa; p=<your public key>

Campaign Monitor accepts your selector, public key and private key, but recommends letting it generate new keys.

DMARC (if the domain has none)

Type: TXT · Host: _dmarc Copy

v=DMARC1; p=none;

Set it up and turn on signing

1. Click your profile image, choose Account settings, then Sending domains, and click Set up a sending domain (or Add domain).
2. Enter the fully qualified domain you send from, such as mail.example.com. Campaign Monitor refuses generic mailbox domains and unregistered ones.
3. Create the cm._domainkey TXT record with a TTL of at least 300 seconds (GoDaddy's minimum is 600), and the _dmarc record unless one already verifies.
4. Select I've added the records. If you leave first, Re-check record in Sending domains runs the check later.
5. If someone else runs DNS, click Share instructions to send them the exact records.

DMARC alignment

Once the key verifies, Campaign Monitor signs with your sending domain, which is what DMARC compares with the From address. Without it, Gmail shows "via" and Outlook 2016 shows "sent by" beside your name. Authentication is per domain: example.com and mail.example.com are separate, so the domain you authenticate must be the one in your campaigns' From address.

Key length and rotation

With generated keys, the public key sits in your own zone as a TXT record, so any new key means replacing that record. With existing keys you control the pair and the selector, and rotating is a matter of publishing a new selector before giving Campaign Monitor the new private key. Campaign Monitor doesn't state a key length or schedule.

Common mistakes

• A DNS host that drops semicolons or underscores. Escape semicolons as \; if allowed; without underscore support you need another DNS provider.
• Authenticating the wrong level of the domain. A key on example.com doesn't cover mail from mail.example.com.
• A domain already used with another email provider. Campaign Monitor says such domains won't authenticate through this process.
• Checking before the TTL has passed. DKIM usually validates in about 5 minutes at the default TTL; wait out the TTL and re-check.