DKIM record for MailerLite

The DNS records

MailerLite's Cloudflare and troubleshooting articles give these DKIM values. Copy the SPF and verification values from your own account, because the verification value is unique to it.

DKIM selector litesrv

Type: CNAME · Host: litesrv._domainkey Copy

litesrv._domainkey.mlsend.com

Some hosts want a trailing period (litesrv._domainkey.mlsend.com.) so they don't append your domain to the target.

SPF record (on the same host as any existing SPF record)

Type: TXT · Host: @ Copy

v=spf1 a mx include:_spf.mlsend.com ~all

MailerLite's example. Merge the include into an existing record instead of adding a second one.

Domain verification

Type: TXT · Host: @ Copy

<verification value shown in MailerLite>

Set it up and turn on signing

1. Go to Account settings, select the Domains tab and click + Add sending domain. Enter the address you send from and click Save.
2. If your DNS provider is a MailerLite partner, use the automatic option. Otherwise choose Authenticate manually.
3. Create the CNAME with the name litesrv._domainkey only; MailerLite says adding your domain to the end of the name isn't necessary. At Cloudflare, set the record to DNS only.
4. Add the SPF and verification TXT records, leaving TTL at the default.
5. Back in MailerLite, open the … menu next to the domain and click Check DNS records.

DMARC alignment

The litesrv key lets MailerLite put your domain in the DKIM signature, so the DKIM result matches the domain in your From address and DMARC can pass on it. MailerLite requires this authentication before you send from a custom domain once the 14-day trial ends. Its help articles don't describe a custom return path, so plan on DKIM as the aligned result.

Key length and rotation

Because the name is a CNAME into mlsend.com, the public key stays in MailerLite's zone and MailerLite can replace it without asking you to edit DNS. The selector litesrv is the same for every account, which is why the record value never changes. MailerLite doesn't publish its key length or a rotation schedule in these articles.

Common mistakes

• A doubled name such as litesrv._domainkey.example.com.example.com. Enter only litesrv._domainkey when your host adds the domain.
• The target rewritten to litesrv._domainkey.mlsend.com.example.com. End the value with a period if your host appends the zone.
• A proxied record at Cloudflare. MailerLite asks for proxy status off (DNS only).
• Records in a zone that isn't live. Check that your nameservers point to the provider where you edited DNS.