Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Fastmail

Fastmail signs mail for a custom domain through three CNAME records, fm1._domainkey, fm2._domainkey and fm3._domainkey, each pointing to a name under dkim.fmhosted.com. Fastmail keeps the keys. If your domain's nameservers are Fastmail's, DKIM is set up for you and you add nothing.

Record type
CNAME
Selectors
fm1, fm2, fm3
Private key held by
Provider (CNAME delegation)

The DNS records

Replace example.com with your domain in both columns. Fastmail's own table lists all records with a one-hour TTL.

Selector fm1

Type: CNAME · Host: fm1._domainkey 

fm1.example.com.dkim.fmhosted.com

Selector fm2

Type: CNAME · Host: fm2._domainkey 

fm2.example.com.dkim.fmhosted.com

Selector fm3

Type: CNAME · Host: fm3._domainkey 

fm3.example.com.dkim.fmhosted.com

Fastmail says to add all three, not just the first.

Set it up and turn on signing

  1. In Fastmail, go to Settings > Domains and click your domain. A domain whose DKIM isn't working shows as Needs attention.
  2. Click Get Instructions for step-by-step setup, including the three DKIM records.
  3. At your DNS host, create the three CNAMEs above with your domain in place of example.com.
  4. If you move the domain's nameservers to Fastmail instead, skip the records: Fastmail sets DKIM up automatically.
  5. Return to Settings > Domains; the warning clears once Fastmail sees the records.

DMARC alignment

The selectors live under your own domain, so once the CNAMEs resolve, Fastmail's signature for your domain aligns with a From address at that domain. Until they do, Settings > Domains flags the domain and you may see a warning when sending. Fastmail's SPF record for custom domains ends in ?all, which makes DKIM the more dependable route to DMARC for this provider.

Key length and rotation

Fastmail's help doesn't publish a key length or rotation schedule. What it documents is the setup: three CNAMEs to keys Fastmail hosts, so any key change happens on Fastmail's side. Domains hosted at Fastmail before 2018 may still have a mesmtp._domainkey record pointing to mesmtp.example.com.dkim.fmhosted.com; Fastmail lists it as deprecated.

Common mistakes

  • Adding only fm1. Fastmail asks for all three CNAMEs.
  • Leaving your domain in the target. The target contains your domain in the middle (fm1.example.com.dkim.fmhosted.com); replacing only the start leaves example.com in place and the record points nowhere.
  • Mixing hosting models. If Fastmail hosts your nameservers, records added at your old DNS host have no effect.

Check your Fastmail DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

Do I need to add DKIM records if Fastmail hosts my DNS?

No. When your domain's nameservers are Fastmail's, Fastmail sets DKIM up automatically. You only add the three CNAMEs when another company hosts your DNS.

What is the mesmtp._domainkey record in my Fastmail domain?

An older DKIM selector that Fastmail says is only in use by domains hosted at Fastmail before 2018. New setups use the three fm selectors; follow Get Instructions in Settings > Domains for what your domain needs.

Why does Fastmail say my domain needs attention?

Settings > Domains shows Needs attention when the domain isn't set up correctly, for example when the DKIM records are missing. Click the domain, open Get Instructions and compare each record with what is live in DNS.

Sources

Checked against Fastmail's documentation on October 9, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Fastmail

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated