# DKIM record for Elastic Email

URL: https://iblockspam.com/dkim/elastic-email
Last updated: 2026-11-03

Record type: TXT
Selectors: api
Key managed by: Provider (you publish its key)

Elastic Email uses one fixed DKIM selector, `api`. You publish a TXT record at `api._domainkey.example.com` with the public key Elastic Email shows in your account, alongside its SPF include and a `tracking` CNAME. Elastic Email holds the private key and signs as your domain once the record verifies.

## DNS records

- DKIM key (TXT, host api._domainkey): `k=rsa;t=s;p=<public key from your Elastic Email account>` Some DNS editors want the full name, api._domainkey.example.com.
- Tracking (links and opens, not DKIM) (CNAME, host tracking): `api.elasticemail.com` On Cloudflare, set this record to DNS only. If your host appends your domain, end the value with a period.
- DMARC policy (TXT, host _dmarc): `v=DMARC1;p=none;` Elastic Email's monitoring-only option. It strongly suggests quarantine or reject once mail passes.

## Set it up and turn on signing

- In Elastic Email, go to **Settings > Domains > Manage Domains**, click **Start Verification** and pick the domain option.
- Copy the DKIM value from your account and create a TXT record named `api._domainkey` at your DNS host.
- Add the SPF include and the `tracking` CNAME from the same screen, and a DMARC record on `_dmarc`.
- Allow up to 48 hours for DNS, then return to Manage Domains to see the SPF, DKIM, tracking, MX and DMARC status.

## DMARC alignment

Until a domain is verified, Elastic Email falls back: if no default sender is set, messages from an unverified domain go out as elasticemail.com, which can't align with your From address. After SPF and DKIM verify, the `api` signature carries your domain, and that is the aligned result DMARC checks. Elastic Email treats DMARC as recommended and asks for nothing beyond valid SPF and DKIM.

## Key length and rotation

The selector is the same for every account, so the key itself is what changes, and it sits in your DNS: a new key from Elastic Email means editing the `api._domainkey` TXT value. Elastic Email's verification article doesn't state a key length or a rotation schedule, so check the record against your account after any change it announces.

## Common mistakes

- **Pasting a key from an old guide.** Elastic Email says its sample may be outdated; the value in your account is the one that verifies.
- **A proxied tracking CNAME.** On Cloudflare, an orange-cloud record won't verify; switch it to DNS only.
- **A doubled tracking value.** If your host adds your domain to `api.elasticemail.com`, add a trailing period.
- **Worrying about the MX check.** Elastic Email says the MX status isn't required; it only reflects whether your domain has a mail server.

**Q: What is Elastic Email's DKIM selector?**
`api`. The DKIM record is a TXT record at `api._domainkey.example.com`, so you can look it up in the DKIM Checker with selector `api` once it's published.

**Q: Why do my Elastic Email messages say they come from elasticemail.com?**
Elastic Email uses its own domain when you send from a domain that isn't verified and no default sender is set. Finish DKIM and SPF verification under Manage Domains so it can sign as your domain.

**Q: Which DMARC policy does Elastic Email suggest?**
Its verification article offers `p=none` for monitoring, and strongly suggests quarantine or reject, with `rua` and `ruf` addresses of your own. Start with monitoring, then tighten once reports show your mail passing.

Sources:
- Elastic Email Help Center: How to verify your domain: https://help.elasticemail.com/en/articles/4934400-how-to-verify-your-domain

---

Source: iBlockSpam, https://iblockspam.com/dkim/elastic-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt