Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Kit (formerly ConvertKit)

Kit, formerly ConvertKit, DKIM-signs your mail once you add a verified sending domain. Manual setup is a set of CNAME records: cka._domainkey for DKIM and ckespa for the return path, with targets unique to your account, plus a DMARC TXT record. Kit can also add them for you through Entri when you sign in to your DNS provider.

Record type
CNAME
Selectors
cka
Private key held by
Provider (CNAME delegation)

The DNS records

Kit shows the targets on its Verify your sending domain screen; they differ per account, so copy them from there.

DKIM selector cka

Type: CNAME · Host: cka._domainkey 

<Value shown in Kit>

Return path (SPF)

Type: CNAME · Host: ckespa 

<Value shown in Kit>

DMARC (shown only if your domain has none)

Type: TXT · Host: _dmarc 

<DMARC record shown in Kit, p=none by default>

Set it up and turn on signing

  1. Click Settings in the lower-left corner, then Email, and under Verified Sending Domains click Set up your Verified Sending Domain.
  2. Enter the domain or subdomain and click Next. Kit supports both; a subdomain isn't required.
  3. Try Set this up for me first: Kit uses Entri to detect your DNS provider and add the records after you sign in. Click Validate when it finishes.
  4. For manual setup, copy each record into your DNS provider. Kit says some providers need the short host (cka._domainkey) and others the full one (cka._domainkey.yourdomain.com).
  5. Click Validate. Kit says the DMARC record can take 24 to 48 hours to take effect.

DMARC alignment

Before verification, Kit uses its own return path and its own signature, so neither aligns with your From domain. After it, Kit says your messages are DKIM-signed with your domain, SPF authenticates against your domain through the ckespa return path, and mail can pass DMARC. Kit calls DMARC a requirement for Gmail and Yahoo bulk senders and for Kit Ads.

Key length and rotation

The cka._domainkey CNAME hands the key to Kit, so Kit can change the key behind it without a DNS edit on your side. Kit's help articles don't give a key length or rotation schedule. They do warn not to remove the records, including DMARC, once added, because doing so can hurt deliverability.

Common mistakes

  • Full host where the provider wants the short one, or the reverse. Try both forms before contacting your DNS provider.
  • Periods at Bluehost. Bluehost doesn't accept periods in CNAME records, so Kit says to leave them out there.
  • Records added at the registrar when another platform hosts DNS. Add them where your nameservers point.
  • Expecting instant results. Kit warns of a temporary dip in open rates for two to three weeks after switching to your own domain.

Check your Kit DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

What DKIM selector does Kit (ConvertKit) use?

cka. The record is a CNAME named cka._domainkey on your verified sending domain, pointing to a target Kit generates for your account. Kit's return-path record uses the host ckespa.

Should I set up a subdomain for Kit?

You don't have to. Kit says a top-level domain works as a verified sending domain and its records won't interfere with the domain. You can still verify a subdomain if you prefer.

Where do I find Kit's DMARC record?

Under Settings, Email, in the Verified Sending Domain section; click Show DNS records if they're hidden. Kit's default record uses p=none. If no DMARC row is shown, your domain already has a DMARC record.

Sources

Checked against Kit's documentation on November 3, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Kit

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated