Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for iCloud Mail (custom domain)

For a custom email domain in iCloud Mail, Apple's DKIM record is a single CNAME with host sig1._domainkey. Its value is built from your own domain: for example.com it is sig1.dkim.example.com.at.icloudmailadmin.com. Apple holds the key behind that name. You add it with the verification TXT, SPF and MX records, then click Verify.

Record type
CNAME
Selectors
sig1
Private key held by
Provider (CNAME delegation)

The DNS records

Replace example.com in the value with your own domain name. Apple asks for a TTL of 3600 seconds (one hour).

DKIM selector sig1

Type: CNAME · Host: sig1._domainkey 

sig1.dkim.example.com.at.icloudmailadmin.com.

For yourshop.net the value becomes sig1.dkim.yourshop.net.at.icloudmailadmin.com. If your registrar rejects the trailing period, leave it out.

Set it up and turn on signing

  1. Start adding the domain in iCloud Mail and enter the addresses you already use there. Apple then lists the records for your domain.
  2. At your registrar, delete the existing MX records, then add the verification TXT record, the SPF TXT record, the two MX records and the sig1._domainkey CNAME.
  3. Write your own domain into the CNAME value where Apple's example says example.com. Set the TTL to 3600.
  4. Save, return to the iCloud Mail setup page and click Verify. Apple says verification can take a few minutes.
  5. To confirm, sign in at icloud.com/icloudplus, open the Custom Email Domain widget and click Manage.

DMARC alignment

The CNAME sits under your domain's _domainkey name, so a signature that uses the sig1 selector is checked against a key published for your domain rather than for icloud.com. That is the record a receiver looks up when DMARC needs DKIM to match your From address. Apple's page lists the record but doesn't describe the signature header itself, so send a test message and read its headers to see the d= and s= values.

Key length and rotation

Because you publish a CNAME, the key itself stays in Apple's zone under icloudmailadmin.com, and Apple can change it there without asking you to edit DNS. Apple doesn't document a key length or a rotation schedule for custom domains. If the domain stops verifying, check that the CNAME still resolves.

Common mistakes

  • Leaving example.com in the target. The value must contain your own domain between sig1.dkim. and .at.icloudmailadmin.com.
  • A TXT record instead of a CNAME. Apple's DKIM record is a CNAME; there is no key to paste.
  • The domain doubled in the host. Enter sig1._domainkey at hosts that append your domain, not the full name.
  • A registrar lock. Apple says a locked domain can't be set up with iCloud Mail at all.

Check your iCloud Mail DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

What is the iCloud Mail DKIM selector for a custom domain?

sig1. Apple's record is a CNAME at sig1._domainkey on your domain, pointing to sig1.dkim.<your domain>.at.icloudmailadmin.com. The DKIM Checker below is prefilled with that selector.

Why does the iCloud DKIM CNAME contain my domain name?

Apple builds a separate target for each custom domain, so the value includes your domain between sig1.dkim. and .at.icloudmailadmin.com. Copying Apple's example.com version points your selector at a name that doesn't hold your key.

My registrar won't accept the trailing period in Apple's CNAME. What now?

Apple says that if your registrar doesn't accept quotes or trailing periods, you can omit them. The same goes for @ as a host: if it isn't accepted, Apple says to enter your domain name instead.

Sources

Checked against iCloud Mail's documentation on October 22, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for iCloud Mail

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated