Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for MailerSend

MailerSend authenticates a domain with two DKIM CNAME records. Its API example names them ms1._domainkey and ms2._domainkey, pointing to ms1._domainkey.mailersend.net and ms2._domainkey.mailersend.net. MailerSend hosts the 2048-bit keys behind them. Both CNAMEs, the SPF record and an mta return-path CNAME are needed to verify.

Record type
CNAME
Selectors
ms1, ms2
Private key held by
Provider (CNAME delegation)

The DNS records

MailerSend shows the Name and Value of each record in your account. The values below come from the example in its API reference; copy yours from the Domains page.

DKIM, first record

Type: CNAME · Host: ms1._domainkey 

ms1._domainkey.mailersend.net

DKIM, second record

Type: CNAME · Host: ms2._domainkey 

ms2._domainkey.mailersend.net

MailerSend says a domain won't verify if either DKIM record is missing.

Return path (bounces and SPF)

Type: CNAME · Host: mta 

mailersend.net

mta is the default host; change it with Edit on the Domains page.

Set it up and turn on signing

  1. In MailerSend, go to Email > Domains, click Add domain, enter the domain and confirm.
  2. Use automatic authentication through your registrar login, or close the pop-up and add the records yourself.
  3. Create both DKIM CNAMEs, the mta return-path CNAME and the merged SPF TXT record exactly as shown.
  4. Tick I have added DNS records and click Finish verification. If the domain isn't verified within 48 hours, click Re-check now.

DMARC alignment

Both CNAMEs sit on your domain, so the signature MailerSend adds uses your domain and aligns with your From address. The bounce address uses the mta subdomain, which lets SPF align under relaxed DMARC too. MailerSend doesn't publish a DMARC record for you; it offers DMARC monitoring as a separate feature, with 30 free days on Starter plans.

Key length and rotation

MailerSend says it is upgrading DKIM from 1024-bit to 2048-bit keys, and that the upgrade is why it now uses two CNAME records instead of one. You don't need to delete an existing DKIM record yet. Because the CNAMEs point at MailerSend's hosts, later key changes happen on its side. It doesn't publish a rotation schedule.

Common mistakes

  • Only one DKIM CNAME. MailerSend needs both before the domain verifies.
  • Deleting the older DKIM record too early. MailerSend says you don't need to remove it yet during the 2048-bit upgrade.
  • The wrong host format. On Google Domains, MailerSend says the return-path host is just mta; DNS hosts that append the domain double longer names.
  • Expecting a DMARC record to appear. MailerSend doesn't create one; publish it yourself on _dmarc.

Check your MailerSend DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

Why does MailerSend use two DKIM records?

MailerSend says it is moving from 1024-bit to 2048-bit keys and now uses two CNAME records instead of one for that. Publish both; a domain with only one won't verify.

Where do MailerSend's DKIM CNAMEs point?

In MailerSend's API example, ms1._domainkey points to ms1._domainkey.mailersend.net and ms2._domainkey to ms2._domainkey.mailersend.net. Use the exact Name and Value your Domains page shows.

Do I need to delete my old MailerSend DKIM record?

Not yet. MailerSend says you don't need to delete the existing DKIM record while it upgrades to the two 2048-bit CNAMEs. Keep it in place alongside the new CNAMEs until MailerSend's instructions change.

Sources

Checked against MailerSend's documentation on November 3, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for MailerSend

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated