# DKIM record for Squarespace Email Campaigns

URL: https://iblockspam.com/dkim/squarespace
Last updated: 2026-10-22

Record type: CNAME
Selectors: squarespace
Key managed by: Provider (CNAME delegation)

Squarespace Email Campaigns verifies a third-party domain with one DKIM CNAME, `squarespace._domainkey`, pointing to `squarespace-domainkey.squarespace-mail.com`, and one TXT record at `_dmarc` with a value unique to your account. The CNAME target is the same for everyone. Domains bought from Squarespace are verified automatically.

## DNS records

- DKIM selector squarespace (CNAME, host squarespace._domainkey): `squarespace-domainkey.squarespace-mail.com`
- DMARC record (TXT, host _dmarc): `<unique value shown beside _dmarc in Squarespace>` A domain has one DMARC record; if you already publish one, merge rather than add.

## Set it up and turn on signing

- Open the Email Campaigns settings panel, add a sender name and address on your domain, and enter the code Squarespace emails to it.
- Under **Sender details**, click **Authenticate** to open the window with the CNAME and TXT records.
- Find where your DNS lives. A domain connected to a Squarespace site with Nameserver connect is edited in the Squarespace domains panel (**Domains managed by third-party > Edit > DNS settings > Add Record**); with DNS connect, use your provider's dashboard.
- Add both records, matching Squarespace's Type, Host and Data values, and save.
- Records can take up to 48 hours to resolve. The domain is verified when "Domain is unauthenticated" no longer shows under it.

## DMARC alignment

Verifying the domain is what lets Squarespace sign campaigns with your domain's selector, so DMARC can pass on DKIM. Squarespace dropped its old SPF record requirement, which means DKIM carries the alignment. If your domain's DMARC policy is `p=reject`, Squarespace won't let you use the sender details at all until verification succeeds.

## Key length and rotation

The CNAME hands the key to Squarespace: `squarespace-domainkey.squarespace-mail.com` is a name it controls, so it can replace the key behind it without a change in your zone. Squarespace doesn't publish a key length or rotation schedule. When we looked it up on 22 October 2026, the target held a 2048-bit RSA key.

## Common mistakes

- **Adding records at the wrong place.** With DNS connect, the records go at your domain provider, not in Squarespace.
- **A second DMARC record.** Merge Squarespace's suggestion into your existing `_dmarc` record.
- **Mixing up the labels.** Squarespace's Type, Host and Data may be called Record, Hostname or Alias, and Points To or Value at your DNS provider.
- **Expecting it for a Squarespace domain.** Squarespace-hosted and migrated Google Domains names need no records.

**Q: What is the Squarespace DKIM CNAME?**
Host `squarespace._domainkey`, data `squarespace-domainkey.squarespace-mail.com`. It is the same for every account. Squarespace also asks for a TXT record at `_dmarc` with a value unique to you.

**Q: Where do I add Squarespace's records if my domain uses Nameserver connect?**
In the Squarespace domains panel: click Domains managed by third-party, then Edit, then DNS settings, and under Custom Records click Add Record. With DNS connect, add them at your domain provider instead.

**Q: Can I send Squarespace campaigns from a domain with p=reject before verifying it?**
No. Squarespace says that if your domain's DMARC policy is `p=reject`, you can't use your sender details until the domain is verified. Add the DKIM CNAME and `_dmarc` record first.

Sources:
- Squarespace Help: Verify your third-party domain for use with Email Campaigns: https://support.squarespace.com/hc/en-us/articles/360001280748-Verify-your-third-party-domain-for-use-with-Email-Campaigns

---

Source: iBlockSpam, https://iblockspam.com/dkim/squarespace (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt