# DKIM record for Fastmail

URL: https://iblockspam.com/dkim/fastmail
Last updated: 2026-10-09

Record type: CNAME
Selectors: fm1, fm2, fm3
Key managed by: Provider (CNAME delegation)

Fastmail signs mail for a custom domain through three CNAME records, `fm1._domainkey`, `fm2._domainkey` and `fm3._domainkey`, each pointing to a name under `dkim.fmhosted.com`. Fastmail keeps the keys. If your domain's nameservers are Fastmail's, DKIM is set up for you and you add nothing.

## DNS records

- Selector fm1 (CNAME, host fm1._domainkey): `fm1.example.com.dkim.fmhosted.com`
- Selector fm2 (CNAME, host fm2._domainkey): `fm2.example.com.dkim.fmhosted.com`
- Selector fm3 (CNAME, host fm3._domainkey): `fm3.example.com.dkim.fmhosted.com` Fastmail says to add all three, not just the first.

## Set it up and turn on signing

- In Fastmail, go to **Settings > Domains** and click your domain. A domain whose DKIM isn't working shows as **Needs attention**.
- Click **Get Instructions** for step-by-step setup, including the three DKIM records.
- At your DNS host, create the three CNAMEs above with your domain in place of `example.com`.
- If you move the domain's nameservers to Fastmail instead, skip the records: Fastmail sets DKIM up automatically.
- Return to Settings > Domains; the warning clears once Fastmail sees the records.

## DMARC alignment

The selectors live under your own domain, so once the CNAMEs resolve, Fastmail's signature for your domain aligns with a From address at that domain. Until they do, Settings > Domains flags the domain and you may see a warning when sending. Fastmail's SPF record for custom domains ends in `?all`, which makes DKIM the more dependable route to DMARC for this provider.

## Key length and rotation

Fastmail's help doesn't publish a key length or rotation schedule. What it documents is the setup: three CNAMEs to keys Fastmail hosts, so any key change happens on Fastmail's side. Domains hosted at Fastmail before 2018 may still have a `mesmtp._domainkey` record pointing to `mesmtp.example.com.dkim.fmhosted.com`; Fastmail lists it as deprecated.

## Common mistakes

- **Adding only fm1.** Fastmail asks for all three CNAMEs.
- **Leaving your domain in the target.** The target contains your domain in the middle (`fm1.example.com.dkim.fmhosted.com`); replacing only the start leaves `example.com` in place and the record points nowhere.
- **Mixing hosting models.** If Fastmail hosts your nameservers, records added at your old DNS host have no effect.

**Q: Do I need to add DKIM records if Fastmail hosts my DNS?**
No. When your domain's nameservers are Fastmail's, Fastmail sets DKIM up automatically. You only add the three CNAMEs when another company hosts your DNS.

**Q: What is the mesmtp._domainkey record in my Fastmail domain?**
An older DKIM selector that Fastmail says is only in use by domains hosted at Fastmail before 2018. New setups use the three `fm` selectors; follow Get Instructions in Settings > Domains for what your domain needs.

**Q: Why does Fastmail say my domain needs attention?**
Settings > Domains shows Needs attention when the domain isn't set up correctly, for example when the DKIM records are missing. Click the domain, open Get Instructions and compare each record with what is live in DNS.

Sources:
- Fastmail Help: Manual DNS configuration: https://www.fastmail.help/hc/en-us/articles/360060591153
- Fastmail Help: Why do I need DKIM?: https://www.fastmail.help/hc/en-us/articles/4627098536207
- Fastmail Help: Custom domains with Fastmail: https://www.fastmail.help/hc/en-us/articles/360058753394

---

Source: iBlockSpam, https://iblockspam.com/dkim/fastmail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt