# DKIM record for Postmark URL: https://iblockspam.com/dkim/postmark Last updated: 2026-10-09 Record type: TXT Selectors: pm (e.g. 20131031155228pm) Key managed by: Provider (you publish its key) Postmark DKIM is one TXT record whose selector is a timestamp followed by `pm`, such as `20131031155228pm._domainkey`. Postmark generates a 1024-bit key; you publish it and click Verify. A separate, optional Return-Path CNAME (`pm-bounces` pointing to `pm.mtasv.net`) makes SPF align too. ## DNS records - DKIM key (Postmark's example selector) (TXT, host 20131031155228pm._domainkey): `k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…` Your selector carries the date and time your key was created. Copy it from DNS Settings. - Custom Return-Path (for SPF alignment) (CNAME, host pm-bounces): `pm.mtasv.net` `pm-bounces` is Postmark's default name; you can choose another, then enter it in the Return-Path section of DNS Settings. ## Set it up and turn on signing - In Postmark, open **Sender Signatures** and choose **DNS Settings** (or **Add a DKIM DNS record**) for your domain. - Copy the host, which looks like `20131031155228pm._domainkey`, and the TXT value. - Create the TXT record at your DNS host and click **Verify**. Postmark says it verifies within 48 hours. - Optionally, in the **Return-Path** section of the same page, add the `pm-bounces` CNAME and verify it. ## DMARC alignment After verification, Postmark signs mail from the domain with DKIM. Without a custom Return-Path, the bounce address is `pm_bounces@pm.mtasv.net`, and Postmark notes SPF then won't pass for DMARC alignment, so DKIM is the only aligned result until you add the CNAME. ## Key length and rotation Postmark says it uses 1024-bit keys, the minimum RFC 8301 allows. It documents rotation on request rather than on a schedule: the Domains API's rotate call creates a new key and selector, which waits as pending until you publish and verify it, and the API reports when the old record is safe to remove. Because the selector carries a timestamp, the old and new keys never share a name. ## Common mistakes - **Shortening the selector.** The whole timestamp plus `pm` is the selector; `pm._domainkey` alone doesn't exist. - **Deleting the old record straight after a rotation.** Wait until Postmark reports it is safe to remove. - **Stopping at DKIM.** Without the Return-Path CNAME, SPF never aligns, so a DKIM failure means a DMARC failure. **Q: Why does my Postmark DKIM selector look like a date?** Postmark names each key after the moment it was created, for example `20131031155228pm`. A rotated key gets a new timestamp, so old and new records can be published side by side without clashing. **Q: Do I need the Postmark Return-Path record if DKIM passes?** Not for DMARC to pass, since an aligned DKIM signature is enough. But without it, SPF can't align, so any DKIM failure becomes a DMARC failure. Adding the `pm-bounces` CNAME gives you a second aligned check. **Q: What DKIM key length does Postmark use?** 1024 bits, according to Postmark's DKIM article. Rotation is on request through its Domains API, which issues a new key under a new timestamped selector and tells you when the old record can go. Sources: - Postmark Support: How do I set up DKIM for Postmark?: https://postmarkapp.com/support/article/1091-how-do-i-set-up-dkim-for-postmark - Postmark Support: How do I add a custom return-path?: https://postmarkapp.com/support/article/910-adding-a-custom-return-path-domain - Postmark Developer Docs: Domains API: https://postmarkapp.com/developer/api/domains-api --- Source: iBlockSpam, https://iblockspam.com/dkim/postmark (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt