# DKIM record for IONOS Mail

URL: https://iblockspam.com/dkim/ionos
Last updated: 2026-11-03

Record type: CNAME
Selectors: s1-ionos, s2-ionos, s42582890
Key managed by: Provider (CNAME delegation)

IONOS activates DKIM by default and creates the records itself when IONOS name servers host your domain. If another company hosts your DNS, IONOS asks for three CNAMEs there: `s1-ionos._domainkey` to `s1.dkim.ionos.com`, `s2-ionos._domainkey` to `s2.dkim.ionos.com`, and `s42582890._domainkey` to `s42582890.dkim.ionos.com`.

## DNS records

- Selector s1-ionos (CNAME, host s1-ionos._domainkey): `s1.dkim.ionos.com`
- Selector s2-ionos (CNAME, host s2-ionos._domainkey): `s2.dkim.ionos.com`
- Selector s42582890 (CNAME, host s42582890._domainkey): `s42582890.dkim.ionos.com` For a subdomain, IONOS prefixes each host, for example `s1-ionos._domainkey.shop` for shop.example.com.

## Set it up and turn on signing

- Check where your domain's DNS is hosted. On IONOS name servers (the default), DKIM is already active and you add nothing.
- If you removed the records and need to reactivate DKIM in IONOS, add them under the domain's DNS settings with **Add record > CNAME**.
- If another provider hosts your DNS zone, create the three CNAMEs above in that provider's DNS panel.
- Enter only the host part, such as `s1-ionos._domainkey`, where your provider appends the domain.
- Wait for the one-hour TTL to pass, then check `s1-ionos` with the DKIM Checker below.

## DMARC alignment

The selectors sit under your domain's `_domainkey` name and point into `dkim.ionos.com`, so receivers fetch IONOS's key through a name on your domain. That is what lets a DKIM pass for IONOS Mail line up with your From address in DMARC. IONOS presents DKIM as working alongside SPF and DMARC against spoofing and spam filtering, but its DKIM article doesn't give a DMARC value, so publish your own once both pass.

## Key length and rotation

None of the three records holds a key: each is an alias into IONOS's zone, where IONOS controls what the selectors return. IONOS's help doesn't explain why it uses three selectors or document a key length or rotation schedule. Keep all three in place, because removing one can leave mail signed with that selector unverifiable.

## Common mistakes

- **The full name in the host field.** At providers that add the domain, `s1-ionos._domainkey.example.com` becomes a malformed, doubled name.
- **Only two of the three records.** IONOS lists `s42582890._domainkey` along with the two `s1`/`s2` records.
- **TXT instead of CNAME.** IONOS's records are CNAMEs; there is no key for you to paste.
- **Records added in IONOS while outside name servers are active.** They only take effect at the provider that hosts the zone.

**Q: Is DKIM turned on automatically for IONOS Mail?**
Yes, when IONOS name servers host your domain: IONOS says DKIM is activated by default and creates the DNS records itself. You only add the three CNAMEs by hand when another company manages your DNS zone, or to reactivate DKIM.

**Q: What is the s42582890._domainkey record from IONOS?**
It is the third of IONOS's three DKIM selectors, a CNAME pointing to `s42582890.dkim.ionos.com`. IONOS lists it with `s1-ionos` and `s2-ionos` for every domain on outside DNS, so publish it even though the name looks account-specific.

**Q: How do I add IONOS DKIM to a subdomain?**
Use the same three targets and add the subdomain to each host, for example `s1-ionos._domainkey.shop` for shop.example.com. IONOS's DKIM article shows this pattern for subdomains.

Sources:
- IONOS Help: Email authentication with DKIM: https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/email-authentication-with-dkim

---

Source: iBlockSpam, https://iblockspam.com/dkim/ionos (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt