# DKIM record for SparkPost

URL: https://iblockspam.com/dkim/sparkpost
Last updated: 2026-11-03

Record type: TXT
Selectors: scph<number> (generated, e.g. scph0316), your own (API)
Key managed by: Provider (you publish its key)

SparkPost DKIM is one TXT record per sending domain, published at `<selector>._domainkey`. When SparkPost creates the key, its examples use selectors such as `scph0316`, and new domains get a 2048-bit key. Through the API you can also supply your own key pair and selector. A separate bounce-domain CNAME to `sparkpostmail.com` covers the return path.

## DNS records

- DKIM key generated by SparkPost (TXT, host scph0316._domainkey): `v=DKIM1; k=rsa; h=sha256; p=<public key from SparkPost>` scph0316 is SparkPost's example selector. If you sign for a subdomain, the name becomes `<selector>._domainkey.<subdomain>`.
- Your own key under your own selector (API) (TXT, host <selector>._domainkey): `v=DKIM1; k=rsa; h=sha256; p=<your public key>` Supply the private key, public key and selector together when you create or update the sending domain.
- Bounce domain (for the return path, not DKIM) (CNAME, host bounces): `sparkpostmail.com` SparkPost EU accounts use eu.sparkpostmail.com; Enterprise accounts use <public_tenant_id>.mail.e.sparkpost.com.

## Set it up and turn on signing

- Create the sending domain in SparkPost (in the app or with `POST /api/v1/sending-domains`). Let SparkPost generate the key, or send your own `private`, `public` and `selector` values.
- Publish the TXT record at the `_domainkey` name SparkPost returns. Keys over 1024 bits need a TXT value split into several strings; SparkPost says to use 1024 bits if your DNS host can't do that.
- Ask SparkPost to check it (`dkim_verify` in the API). Verify within two weeks, or SparkPost removes the domain from your account.
- Optionally add a bounce subdomain with a CNAME to your account's SparkPost domain and verify it with `cname_verify`.

## DMARC alignment

With the TXT key verified, SparkPost signs your messages with your domain, so the DKIM result can align with your From address under DMARC. SparkPost lets you verify a domain through a mailbox instead of DNS, but warns that it can't DKIM-sign mail for a domain verified that way. Use DNS verification if you want an aligned signature.

## Key length and rotation

New sending domains default to a 2048-bit key, and keys you supply must be between 1024 and 4096 bits. A domain can hold up to 256 additional DKIM keys, which helps when you change keys: publish the new selector first, then switch. Replacing the main key means sending a new private key, public key and selector together, and that resets the domain's DKIM status to unverified until the new TXT record is checked. SparkPost doesn't publish a rotation schedule.

## Common mistakes

- **One string for a 2048-bit key.** Many DNS hosts reject a TXT value that long. Split it into strings or choose a 1024-bit key.
- **Mailbox verification.** It lets you send, but SparkPost then can't DKIM-sign, so DMARC has nothing aligned to rely on.
- **Changing the key fields without republishing.** Any change to `signing_domain` or the key resets `dkim_status` to unverified.
- **Waiting too long.** Sending domains that stay unverified for two weeks are removed.

**Q: What does the scph selector in SparkPost DKIM mean?**
It is the name SparkPost's examples give a generated key, such as `scph0316`, and the record lives at `scph0316._domainkey.example.com`. Your account may show a different selector, so publish the one it returns.

**Q: Can I use my own DKIM key with SparkPost?**
Yes. When you create or update a sending domain through the API, send your private key, public key and selector together. Publish the public key as a TXT record at `<selector>._domainkey` and verify it.

**Q: Why can't SparkPost sign my mail after mailbox verification?**
Mailbox verification only proves you control an address at the domain; no DKIM key is published in DNS. SparkPost says it then can't DKIM-sign, which can hurt delivery, so it recommends DNS verification wherever possible.

Sources:
- SparkPost API Reference: Sending Domains: https://developers.sparkpost.com/api/sending-domains/

---

Source: iBlockSpam, https://iblockspam.com/dkim/sparkpost (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt