DKIM record for IONOS Mail

The DNS records

The targets are the same for every domain. IONOS lists a TTL of one hour for each record.

Selector s1-ionos

Type: CNAME · Host: s1-ionos._domainkey Copy

s1.dkim.ionos.com

Selector s2-ionos

Type: CNAME · Host: s2-ionos._domainkey Copy

s2.dkim.ionos.com

Selector s42582890

Type: CNAME · Host: s42582890._domainkey Copy

s42582890.dkim.ionos.com

For a subdomain, IONOS prefixes each host, for example s1-ionos._domainkey.shop for shop.example.com.

Set it up and turn on signing

1. Check where your domain's DNS is hosted. On IONOS name servers (the default), DKIM is already active and you add nothing.
2. If you removed the records and need to reactivate DKIM in IONOS, add them under the domain's DNS settings with Add record > CNAME.
3. If another provider hosts your DNS zone, create the three CNAMEs above in that provider's DNS panel.
4. Enter only the host part, such as s1-ionos._domainkey, where your provider appends the domain.
5. Wait for the one-hour TTL to pass, then check s1-ionos with the DKIM Checker below.

DMARC alignment

The selectors sit under your domain's _domainkey name and point into dkim.ionos.com, so receivers fetch IONOS's key through a name on your domain. That is what lets a DKIM pass for IONOS Mail line up with your From address in DMARC. IONOS presents DKIM as working alongside SPF and DMARC against spoofing and spam filtering, but its DKIM article doesn't give a DMARC value, so publish your own once both pass.

Key length and rotation

None of the three records holds a key: each is an alias into IONOS's zone, where IONOS controls what the selectors return. IONOS's help doesn't explain why it uses three selectors or document a key length or rotation schedule. Keep all three in place, because removing one can leave mail signed with that selector unverifiable.

Common mistakes

• The full name in the host field. At providers that add the domain, s1-ionos._domainkey.example.com becomes a malformed, doubled name.
• Only two of the three records. IONOS lists s42582890._domainkey along with the two s1/s2 records.
• TXT instead of CNAME. IONOS's records are CNAMEs; there is no key for you to paste.
• Records added in IONOS while outside name servers are active. They only take effect at the provider that hosts the zone.