DKIM record for Elastic Email

The DNS records

Elastic Email asks you to copy the DKIM value from your account rather than from an older guide, because its sample keys may be out of date.

DKIM key

Type: TXT · Host: api._domainkey Copy

k=rsa;t=s;p=<public key from your Elastic Email account>

Some DNS editors want the full name, api._domainkey.example.com.

Tracking (links and opens, not DKIM)

Type: CNAME · Host: tracking Copy

api.elasticemail.com

On Cloudflare, set this record to DNS only. If your host appends your domain, end the value with a period.

DMARC policy

Type: TXT · Host: _dmarc Copy

v=DMARC1;p=none;

Elastic Email's monitoring-only option. It strongly suggests quarantine or reject once mail passes.

Set it up and turn on signing

1. In Elastic Email, go to Settings > Domains > Manage Domains, click Start Verification and pick the domain option.
2. Copy the DKIM value from your account and create a TXT record named api._domainkey at your DNS host.
3. Add the SPF include and the tracking CNAME from the same screen, and a DMARC record on _dmarc.
4. Allow up to 48 hours for DNS, then return to Manage Domains to see the SPF, DKIM, tracking, MX and DMARC status.

DMARC alignment

Until a domain is verified, Elastic Email falls back: if no default sender is set, messages from an unverified domain go out as elasticemail.com, which can't align with your From address. After SPF and DKIM verify, the api signature carries your domain, and that is the aligned result DMARC checks. Elastic Email treats DMARC as recommended and asks for nothing beyond valid SPF and DKIM.

Key length and rotation

The selector is the same for every account, so the key itself is what changes, and it sits in your DNS: a new key from Elastic Email means editing the api._domainkey TXT value. Elastic Email's verification article doesn't state a key length or a rotation schedule, so check the record against your account after any change it announces.

Common mistakes

• Pasting a key from an old guide. Elastic Email says its sample may be outdated; the value in your account is the one that verifies.
• A proxied tracking CNAME. On Cloudflare, an orange-cloud record won't verify; switch it to DNS only.
• A doubled tracking value. If your host adds your domain to api.elasticemail.com, add a trailing period.
• Worrying about the MX check. Elastic Email says the MX status isn't required; it only reflects whether your domain has a mail server.