# DKIM record for Mailjet

URL: https://iblockspam.com/dkim/mailjet
Last updated: 2026-10-22

Record type: TXT
Selectors: mailjet
Key managed by: Provider (you publish its key)

Mailjet's DKIM record is a TXT record at `mailjet._domainkey` on your domain. Its value, starting with `k=rsa; p=`, is a public key Mailjet generates; you find it in your account under SPF/DKIM Authentication. New keys are 2048 bits by default, and you can regenerate the key as 1024, 2048 or 4096 bits once the whole domain is validated.

## DNS records

- Mailjet DKIM key (TXT, host mailjet._domainkey): `k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNAD…` Mailjet notes that some DNS hosts need the whole TXT value in double quotes.

## Set it up and turn on signing

- Validate the sending domain in Mailjet first: on the Domains and Senders page in your account settings, click the cog next to the domain and choose **Validate**, then add the TXT record Mailjet shows.
- Open the SPF/DKIM Authentication section to see the DKIM host and value for the domain.
- At your DNS host, add a TXT record named `mailjet._domainkey` with that value. Check afterwards that the host didn't append your domain a second time.
- Back in Mailjet, open **Account Settings > Domains & DNS** and select the domain. A green check mark next to DKIM means the key was found.

## DMARC alignment

Once the TXT record is live, Mailjet signs with your domain, so the DKIM result aligns with a From address at that domain and DMARC can pass on it. Mailjet presents SPF (`include:spf.mailjet.com`) and DKIM as a pair and recommends adding DMARC on top. It also says its support only gives guidelines for DMARC and doesn't analyze reports.

## Key length and rotation

Mailjet's key lives in your zone, so a new key means a new TXT value. Use **Regenerate Key** under DKIM in the SPF/DKIM Authentication setup and choose 1024, 2048 (the default) or 4096 bits, then replace the DNS value. Existing domains aren't upgraded automatically. The button stays greyed out if only an address, not the domain, is validated.

## Common mistakes

- **Picking 4096 bits at a host that can't store it.** Mailjet warns some providers truncate long TXT values; regenerate a 1024-bit key if yours does.
- **Regenerating without updating DNS.** The old value in your zone no longer matches the key Mailjet signs with.
- **Extra spaces in the value.** Mailjet says the TXT record must match what it provides exactly.
- **Validating only a sender address.** Key regeneration needs the whole domain validated.

**Q: What is Mailjet's DKIM selector?**
`mailjet`. The record is a TXT record at `mailjet._domainkey` on your domain, holding the public key from the SPF/DKIM Authentication section of your Mailjet account.

**Q: How do I change the Mailjet DKIM key length?**
Go to Account, Domains & Sender addresses, SPF/DKIM Authentication, and the setup page; click Regenerate Key under DKIM, choose 1024, 2048 or 4096 bits and confirm. Then replace the TXT value in your DNS with the new one.

**Q: Why is the Regenerate Key button greyed out in Mailjet?**
Mailjet only lets you regenerate the DKIM key when the entire domain is validated. If you validated a single sender address at that domain, validate the domain itself first.

Sources:
- Mailjet Documentation: Authenticating domains with SPF and DKIM, a complete guide: https://documentation.mailjet.com/hc/en-us/articles/360049641733-Authenticating-Domains-with-SPF-and-DKIM-A-Complete-Guide

---

Source: iBlockSpam, https://iblockspam.com/dkim/mailjet (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt