# DKIM record for Campaign Monitor

URL: https://iblockspam.com/dkim/campaign-monitor
Last updated: 2026-11-03

Record type: TXT
Selectors: cm, your own (existing keys)
Key managed by: Provider (you publish its key)

Campaign Monitor generates a DKIM key pair for each sending domain and asks you to publish the public half as a TXT record named `cm._domainkey`, for example `cm._domainkey.mail.example.com`. A `_dmarc` record is required alongside it; SPF is optional. You can also bring existing keys by giving Campaign Monitor the selector and both keys.

## DNS records

- DKIM key (TXT, host cm._domainkey): `<TXT value shown in Campaign Monitor>` Some DNS hosts need the full name, `cm._domainkey.mail.example.com`.
- Existing keys instead (optional) (TXT, host <your selector>._domainkey): `v=DKIM1; k=rsa; p=<your public key>` Campaign Monitor accepts your selector, public key and private key, but recommends letting it generate new keys.
- DMARC (if the domain has none) (TXT, host _dmarc): `v=DMARC1; p=none;`

## Set it up and turn on signing

- Click your profile image, choose **Account settings**, then **Sending domains**, and click **Set up a sending domain** (or **Add domain**).
- Enter the fully qualified domain you send from, such as `mail.example.com`. Campaign Monitor refuses generic mailbox domains and unregistered ones.
- Create the `cm._domainkey` TXT record with a TTL of at least 300 seconds (GoDaddy's minimum is 600), and the `_dmarc` record unless one already verifies.
- Select **I've added the records**. If you leave first, **Re-check record** in Sending domains runs the check later.
- If someone else runs DNS, click **Share instructions** to send them the exact records.

## DMARC alignment

Once the key verifies, Campaign Monitor signs with your sending domain, which is what DMARC compares with the From address. Without it, Gmail shows "via" and Outlook 2016 shows "sent by" beside your name. Authentication is per domain: `example.com` and `mail.example.com` are separate, so the domain you authenticate must be the one in your campaigns' From address.

## Key length and rotation

With generated keys, the public key sits in your own zone as a TXT record, so any new key means replacing that record. With existing keys you control the pair and the selector, and rotating is a matter of publishing a new selector before giving Campaign Monitor the new private key. Campaign Monitor doesn't state a key length or schedule.

## Common mistakes

- **A DNS host that drops semicolons or underscores.** Escape semicolons as `\;` if allowed; without underscore support you need another DNS provider.
- **Authenticating the wrong level of the domain.** A key on `example.com` doesn't cover mail from `mail.example.com`.
- **A domain already used with another email provider.** Campaign Monitor says such domains won't authenticate through this process.
- **Checking before the TTL has passed.** DKIM usually validates in about 5 minutes at the default TTL; wait out the TTL and re-check.

**Q: Where does the Campaign Monitor DKIM record go?**
On the exact sending domain, as a TXT record named `cm._domainkey`. For `mail.example.com` the full name is `cm._domainkey.mail.example.com`; some DNS hosts want that full name, others only `cm._domainkey`.

**Q: Is DMARC required for Campaign Monitor authentication?**
Yes. Campaign Monitor's setup asks for a `_dmarc` TXT record, `v=DMARC1; p=none;` at minimum, unless a valid DMARC record already verifies for the domain. SPF is the optional step.

**Q: Can I use my own DKIM keys with Campaign Monitor?**
Yes. You can give Campaign Monitor an existing selector, public key and private key instead of generated ones, though it recommends generating new keys. Publish the public key at `<selector>._domainkey`.

Sources:
- Campaign Monitor Help: Manage your own authentication: https://help.campaignmonitor.com/s/article/manage-your-own-authentication
- Campaign Monitor Help: Email authentication: https://help.campaignmonitor.com/s/article/email-authentication

---

Source: iBlockSpam, https://iblockspam.com/dkim/campaign-monitor (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt