Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Squarespace Email Campaigns

Squarespace Email Campaigns verifies a third-party domain with one DKIM CNAME, squarespace._domainkey, pointing to squarespace-domainkey.squarespace-mail.com, and one TXT record at _dmarc with a value unique to your account. The CNAME target is the same for everyone. Domains bought from Squarespace are verified automatically.

Record type
CNAME
Selectors
squarespace
Private key held by
Provider (CNAME delegation)

The DNS records

DKIM selector squarespace

Type: CNAME · Host: squarespace._domainkey 

squarespace-domainkey.squarespace-mail.com

DMARC record

Type: TXT · Host: _dmarc 

<unique value shown beside _dmarc in Squarespace>

A domain has one DMARC record; if you already publish one, merge rather than add.

Set it up and turn on signing

  1. Open the Email Campaigns settings panel, add a sender name and address on your domain, and enter the code Squarespace emails to it.
  2. Under Sender details, click Authenticate to open the window with the CNAME and TXT records.
  3. Find where your DNS lives. A domain connected to a Squarespace site with Nameserver connect is edited in the Squarespace domains panel (Domains managed by third-party > Edit > DNS settings > Add Record); with DNS connect, use your provider's dashboard.
  4. Add both records, matching Squarespace's Type, Host and Data values, and save.
  5. Records can take up to 48 hours to resolve. The domain is verified when "Domain is unauthenticated" no longer shows under it.

DMARC alignment

Verifying the domain is what lets Squarespace sign campaigns with your domain's selector, so DMARC can pass on DKIM. Squarespace dropped its old SPF record requirement, which means DKIM carries the alignment. If your domain's DMARC policy is p=reject, Squarespace won't let you use the sender details at all until verification succeeds.

Key length and rotation

The CNAME hands the key to Squarespace: squarespace-domainkey.squarespace-mail.com is a name it controls, so it can replace the key behind it without a change in your zone. Squarespace doesn't publish a key length or rotation schedule. When we looked it up on 22 October 2026, the target held a 2048-bit RSA key.

Common mistakes

  • Adding records at the wrong place. With DNS connect, the records go at your domain provider, not in Squarespace.
  • A second DMARC record. Merge Squarespace's suggestion into your existing _dmarc record.
  • Mixing up the labels. Squarespace's Type, Host and Data may be called Record, Hostname or Alias, and Points To or Value at your DNS provider.
  • Expecting it for a Squarespace domain. Squarespace-hosted and migrated Google Domains names need no records.

Check your Squarespace DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

What is the Squarespace DKIM CNAME?

Host squarespace._domainkey, data squarespace-domainkey.squarespace-mail.com. It is the same for every account. Squarespace also asks for a TXT record at _dmarc with a value unique to you.

Where do I add Squarespace's records if my domain uses Nameserver connect?

In the Squarespace domains panel: click Domains managed by third-party, then Edit, then DNS settings, and under Custom Records click Add Record. With DNS connect, add them at your domain provider instead.

Can I send Squarespace campaigns from a domain with p=reject before verifying it?

No. Squarespace says that if your domain's DMARC policy is p=reject, you can't use your sender details until the domain is verified. Add the DKIM CNAME and _dmarc record first.

Sources

Checked against Squarespace's documentation on October 22, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Squarespace

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated