DKIM record for Rackspace Email

The DNS records

Rackspace generates the key for each domain. Copy the record name and the full value from the Sender Authentication (DKIM) page; the rows below show the shape, not real values.

DKIM key from the Cloud Office Control Panel

Type: TXT · Host: <key name shown by Rackspace>._domainkey Copy

<DKIM value shown in the Cloud Office Control Panel>

Many DNS hosts add your domain to the name for you. Enter only the part Rackspace shows before your domain.

DMARC policy (after SPF and DKIM)

Type: TXT · Host: _dmarc Copy

v=DMARC1; p=none; rua=mailto:<your report address>

Rackspace recommends SPF, then DKIM, then DMARC. Start at p=none and tighten once reports look clean.

Set it up and turn on signing

1. Sign in to the Cloud Office Control Panel at cp.rackspace.com as an administrator.
2. On the home page, in the Domains section, click Sender Authentication (DKIM), then click the domain you want to sign.
3. Click Enable DKIM for the domain. With DNS managed in the Cloud Office Control Panel, Rackspace finishes the setup itself and you can skip the next step.
4. With DNS hosted elsewhere, create a TXT record at that DNS host using the key name and value the page shows.
5. Back in the panel, click Verify TXT Record. If the check fails, the message says what to correct. Rackspace allows about 15 minutes for the record and 24 to 48 hours for propagation.

DMARC alignment

Once enabled, Rackspace signs every new outgoing message from the domain with that domain's key, so the signature's d= matches the address people see in From and DMARC can pass on DKIM. That matters most for forwarded mail, where the SPF result from include:emailsrvr.com no longer holds. Messages sent before you enabled it stay unsigned.

Key length and rotation

The key pair is generated by Rackspace, and the public half sits in your zone as a TXT value, so a replacement key would mean publishing a new record. Rackspace's Cloud Office articles don't state a key length or a rotation schedule. Its Cloud DNS guidance adds that no two services should share a selector, so keep other senders' keys under their own names.

Common mistakes

• Clicking Verify TXT Record seconds after saving. Give DNS time; Rackspace quotes 24 to 48 hours for propagation.
• A doubled name. <key>._domainkey.example.com.example.com happens when the host appends the domain to a full name you pasted.
• Enabling only the main domain. Each domain you send from has its own entry on the Sender Authentication (DKIM) page.
• Reusing the Rackspace selector for another service. Another sender's key under the same name replaces Rackspace's and breaks its signatures.