DKIM record for Customer.io

The DNS records

Replace cio##### with the subdomain Customer.io shows under Show Records, and copy the key value from there.

DKIM key

Type: TXT · Host: cio._domainkey.cio##### Copy

k=rsa; p=<public key shown in Customer.io>

The 2048-bit key is longer than 255 characters. Keep one TXT record and split it into quoted strings if your host asks.

SPF on the account subdomain

Type: TXT · Host: cio##### Copy

<SPF value shown in Customer.io>

DMARC (minimum)

Type: TXT · Host: _dmarc Copy

v=DMARC1; p=none

On your root domain only. If you already have a DMARC policy, Customer.io shows your existing record instead.

Set it up and turn on signing

1. Go to Settings > Workspace Settings > Email, add a sending domain and a from address, and click Show Records.
2. Add the MX record (two hostnames) and the SPF TXT record on the cio##### host, the DKIM TXT record on cio._domainkey.cio#####, and DMARC on _dmarc of the root domain.
3. Enter only the part before your domain (for example cio._domainkey.cio12345) if your DNS host appends it, as GoDaddy does.
4. Click Verify domain. Customer.io checks only when you click, and verification can take up to 72 hours.

DMARC alignment

Customer.io signs the return path, SPF and DKIM with your account subdomain, a child of your From domain. Under DMARC's default relaxed alignment that parent-child match passes. Customer.io warns that setting adkim=s or aspf=s breaks it, so remove those tags or set them to r. It checks _dmarc on the sending domain first, then on the root.

Key length and rotation

The key is generated by Customer.io but stored in your zone, so a new key means replacing the TXT value at cio._domainkey. Customer.io's documentation gives the 2048-bit default but no rotation schedule. Keep the records in place after verification: Customer.io says removing them can cause bounces or spam filtering.

Common mistakes

• A key value cut off at 255 characters. Split it into strings under 255 characters, separated by a space, in the same record; in Terraform use \"\" between the parts.
• A _dmarc record on the subdomain. Customer.io says not to add DMARC to any subdomain.
• Hosts that reject underscores or need escaped semicolons. Ask your host, or write semicolons as \; where required.
• Deleting your own records while adding Customer.io's. That can stop mail to your mailboxes.