# DKIM record for MailerSend

URL: https://iblockspam.com/dkim/mailersend
Last updated: 2026-11-03

Record type: CNAME
Selectors: ms1, ms2
Key managed by: Provider (CNAME delegation)

MailerSend authenticates a domain with two DKIM CNAME records. Its API example names them `ms1._domainkey` and `ms2._domainkey`, pointing to `ms1._domainkey.mailersend.net` and `ms2._domainkey.mailersend.net`. MailerSend hosts the 2048-bit keys behind them. Both CNAMEs, the SPF record and an `mta` return-path CNAME are needed to verify.

## DNS records

- DKIM, first record (CNAME, host ms1._domainkey): `ms1._domainkey.mailersend.net`
- DKIM, second record (CNAME, host ms2._domainkey): `ms2._domainkey.mailersend.net` MailerSend says a domain won't verify if either DKIM record is missing.
- Return path (bounces and SPF) (CNAME, host mta): `mailersend.net` `mta` is the default host; change it with Edit on the Domains page.

## Set it up and turn on signing

- In MailerSend, go to **Email > Domains**, click **Add domain**, enter the domain and confirm.
- Use automatic authentication through your registrar login, or close the pop-up and add the records yourself.
- Create both DKIM CNAMEs, the `mta` return-path CNAME and the merged SPF TXT record exactly as shown.
- Tick **I have added DNS records** and click **Finish verification**. If the domain isn't verified within 48 hours, click **Re-check now**.

## DMARC alignment

Both CNAMEs sit on your domain, so the signature MailerSend adds uses your domain and aligns with your From address. The bounce address uses the `mta` subdomain, which lets SPF align under relaxed DMARC too. MailerSend doesn't publish a DMARC record for you; it offers DMARC monitoring as a separate feature, with 30 free days on Starter plans.

## Key length and rotation

MailerSend says it is upgrading DKIM from 1024-bit to 2048-bit keys, and that the upgrade is why it now uses two CNAME records instead of one. You don't need to delete an existing DKIM record yet. Because the CNAMEs point at MailerSend's hosts, later key changes happen on its side. It doesn't publish a rotation schedule.

## Common mistakes

- **Only one DKIM CNAME.** MailerSend needs both before the domain verifies.
- **Deleting the older DKIM record too early.** MailerSend says you don't need to remove it yet during the 2048-bit upgrade.
- **The wrong host format.** On Google Domains, MailerSend says the return-path host is just `mta`; DNS hosts that append the domain double longer names.
- **Expecting a DMARC record to appear.** MailerSend doesn't create one; publish it yourself on `_dmarc`.

**Q: Why does MailerSend use two DKIM records?**
MailerSend says it is moving from 1024-bit to 2048-bit keys and now uses two CNAME records instead of one for that. Publish both; a domain with only one won't verify.

**Q: Where do MailerSend's DKIM CNAMEs point?**
In MailerSend's API example, `ms1._domainkey` points to `ms1._domainkey.mailersend.net` and `ms2._domainkey` to `ms2._domainkey.mailersend.net`. Use the exact Name and Value your Domains page shows.

**Q: Do I need to delete my old MailerSend DKIM record?**
Not yet. MailerSend says you don't need to delete the existing DKIM record while it upgrades to the two 2048-bit CNAMEs. Keep it in place alongside the new CNAMEs until MailerSend's instructions change.

Sources:
- MailerSend Help: How to add and verify your sending domain: https://www.mailersend.com/help/how-to-verify-and-authenticate-a-sending-domain
- MailerSend API Reference: Domains (Get DNS records): https://developers.mailersend.com/api/v1/domains.html

---

Source: iBlockSpam, https://iblockspam.com/dkim/mailersend (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt