# DKIM record for Customer.io

URL: https://iblockspam.com/dkim/customer-io
Last updated: 2026-11-03

Record type: TXT
Selectors: cio
Key managed by: Provider (you publish its key)

Customer.io generates a 2048-bit DKIM key for each sending domain and asks you to publish it as a TXT record at `cio._domainkey.cio#####.yourdomain.com`, where `cio#####` is your account-specific subdomain. It comes with an MX and an SPF record on that subdomain and a DMARC record on your root. SPF and DKIM must both verify before you can send.

## DNS records

- DKIM key (TXT, host cio._domainkey.cio#####): `k=rsa; p=<public key shown in Customer.io>` The 2048-bit key is longer than 255 characters. Keep one TXT record and split it into quoted strings if your host asks.
- SPF on the account subdomain (TXT, host cio#####): `<SPF value shown in Customer.io>`
- DMARC (minimum) (TXT, host _dmarc): `v=DMARC1; p=none` On your root domain only. If you already have a DMARC policy, Customer.io shows your existing record instead.

## Set it up and turn on signing

- Go to **Settings > Workspace Settings > Email**, add a sending domain and a from address, and click **Show Records**.
- Add the MX record (two hostnames) and the SPF TXT record on the `cio#####` host, the DKIM TXT record on `cio._domainkey.cio#####`, and DMARC on `_dmarc` of the root domain.
- Enter only the part before your domain (for example `cio._domainkey.cio12345`) if your DNS host appends it, as GoDaddy does.
- Click **Verify domain**. Customer.io checks only when you click, and verification can take up to 72 hours.

## DMARC alignment

Customer.io signs the return path, SPF and DKIM with your account subdomain, a child of your From domain. Under DMARC's default relaxed alignment that parent-child match passes. Customer.io warns that setting `adkim=s` or `aspf=s` breaks it, so remove those tags or set them to `r`. It checks `_dmarc` on the sending domain first, then on the root.

## Key length and rotation

The key is generated by Customer.io but stored in your zone, so a new key means replacing the TXT value at `cio._domainkey`. Customer.io's documentation gives the 2048-bit default but no rotation schedule. Keep the records in place after verification: Customer.io says removing them can cause bounces or spam filtering.

## Common mistakes

- **A key value cut off at 255 characters.** Split it into strings under 255 characters, separated by a space, in the same record; in Terraform use `\"\"` between the parts.
- **A `_dmarc` record on the subdomain.** Customer.io says not to add DMARC to any subdomain.
- **Hosts that reject underscores or need escaped semicolons.** Ask your host, or write semicolons as `\;` where required.
- **Deleting your own records while adding Customer.io's.** That can stop mail to your mailboxes.

**Q: What is the Customer.io DKIM host name?**
`cio._domainkey.cio#####.yourdomain.com`, where `cio#####` is your account-specific subdomain. The selector is `cio`, and the record is a TXT key, not a CNAME.

**Q: My DNS host says the Customer.io DKIM value is too long. What do I do?**
The 2048-bit key exceeds the 255-character limit of one TXT string. Keep a single record and split the value into two or more quoted strings of under 255 characters, separated by a space, with no line breaks.

**Q: Why does Customer.io check DMARC on my root domain?**
It looks for `_dmarc` on the sending domain first and falls back to the root domain's record, which covers subdomains. The minimum it accepts is `v=DMARC1; p=none`, published on the root.

Sources:
- Customer.io Docs: Domain authentication: https://docs.customer.io/journeys/authentication/

---

Source: iBlockSpam, https://iblockspam.com/dkim/customer-io (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt