DKIM record for Postmark

The DNS records

DKIM key (Postmark's example selector)

Type: TXT · Host: 20131031155228pm._domainkey Copy

k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…

Your selector carries the date and time your key was created. Copy it from DNS Settings.

Custom Return-Path (for SPF alignment)

Type: CNAME · Host: pm-bounces Copy

pm.mtasv.net

pm-bounces is Postmark's default name; you can choose another, then enter it in the Return-Path section of DNS Settings.

Set it up and turn on signing

1. In Postmark, open Sender Signatures and choose DNS Settings (or Add a DKIM DNS record) for your domain.
2. Copy the host, which looks like 20131031155228pm._domainkey, and the TXT value.
3. Create the TXT record at your DNS host and click Verify. Postmark says it verifies within 48 hours.
4. Optionally, in the Return-Path section of the same page, add the pm-bounces CNAME and verify it.

DMARC alignment

After verification, Postmark signs mail from the domain with DKIM. Without a custom Return-Path, the bounce address is pm_bounces@pm.mtasv.net, and Postmark notes SPF then won't pass for DMARC alignment, so DKIM is the only aligned result until you add the CNAME.

Key length and rotation

Postmark says it uses 1024-bit keys, the minimum RFC 8301 allows. It documents rotation on request rather than on a schedule: the Domains API's rotate call creates a new key and selector, which waits as pending until you publish and verify it, and the API reports when the old record is safe to remove. Because the selector carries a timestamp, the old and new keys never share a name.

Common mistakes

• Shortening the selector. The whole timestamp plus pm is the selector; pm._domainkey alone doesn't exist.
• Deleting the old record straight after a rotation. Wait until Postmark reports it is safe to remove.
• Stopping at DKIM. Without the Return-Path CNAME, SPF never aligns, so a DKIM failure means a DMARC failure.