# DKIM record for iCloud Mail (custom domain)

URL: https://iblockspam.com/dkim/icloud-mail
Last updated: 2026-10-22

Record type: CNAME
Selectors: sig1
Key managed by: Provider (CNAME delegation)

For a custom email domain in iCloud Mail, Apple's DKIM record is a single CNAME with host `sig1._domainkey`. Its value is built from your own domain: for example.com it is `sig1.dkim.example.com.at.icloudmailadmin.com.` Apple holds the key behind that name. You add it with the verification TXT, SPF and MX records, then click Verify.

## DNS records

- DKIM selector sig1 (CNAME, host sig1._domainkey): `sig1.dkim.example.com.at.icloudmailadmin.com.` For `yourshop.net` the value becomes `sig1.dkim.yourshop.net.at.icloudmailadmin.com.` If your registrar rejects the trailing period, leave it out.

## Set it up and turn on signing

- Start adding the domain in iCloud Mail and enter the addresses you already use there. Apple then lists the records for your domain.
- At your registrar, delete the existing MX records, then add the verification TXT record, the SPF TXT record, the two MX records and the `sig1._domainkey` CNAME.
- Write your own domain into the CNAME value where Apple's example says `example.com`. Set the TTL to 3600.
- Save, return to the iCloud Mail setup page and click **Verify**. Apple says verification can take a few minutes.
- To confirm, sign in at icloud.com/icloudplus, open the **Custom Email Domain** widget and click **Manage**.

## DMARC alignment

The CNAME sits under your domain's `_domainkey` name, so a signature that uses the `sig1` selector is checked against a key published for your domain rather than for icloud.com. That is the record a receiver looks up when DMARC needs DKIM to match your From address. Apple's page lists the record but doesn't describe the signature header itself, so send a test message and read its headers to see the `d=` and `s=` values.

## Key length and rotation

Because you publish a CNAME, the key itself stays in Apple's zone under `icloudmailadmin.com`, and Apple can change it there without asking you to edit DNS. Apple doesn't document a key length or a rotation schedule for custom domains. If the domain stops verifying, check that the CNAME still resolves.

## Common mistakes

- **Leaving `example.com` in the target.** The value must contain your own domain between `sig1.dkim.` and `.at.icloudmailadmin.com`.
- **A TXT record instead of a CNAME.** Apple's DKIM record is a CNAME; there is no key to paste.
- **The domain doubled in the host.** Enter `sig1._domainkey` at hosts that append your domain, not the full name.
- **A registrar lock.** Apple says a locked domain can't be set up with iCloud Mail at all.

**Q: What is the iCloud Mail DKIM selector for a custom domain?**
`sig1`. Apple's record is a CNAME at `sig1._domainkey` on your domain, pointing to `sig1.dkim.<your domain>.at.icloudmailadmin.com.` The DKIM Checker below is prefilled with that selector.

**Q: Why does the iCloud DKIM CNAME contain my domain name?**
Apple builds a separate target for each custom domain, so the value includes your domain between `sig1.dkim.` and `.at.icloudmailadmin.com`. Copying Apple's `example.com` version points your selector at a name that doesn't hold your key.

**Q: My registrar won't accept the trailing period in Apple's CNAME. What now?**
Apple says that if your registrar doesn't accept quotes or trailing periods, you can omit them. The same goes for `@` as a host: if it isn't accepted, Apple says to enter your domain name instead.

Sources:
- Apple Support: Set up an existing domain with iCloud Mail: https://support.apple.com/en-us/102374

---

Source: iBlockSpam, https://iblockspam.com/dkim/icloud-mail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt