Set up or repair DKIM signing with cPanel, Cloudflare and external email services Print

Quick answer

To set up DKIM, enable signing at the service that sends the mail, publish that service's exact public TXT or CNAME records at your authoritative DNS provider, and verify a newly sent message. The selector and signing domain must match the actual sender. Keep the private signing key at the sending service.

Applies to

Interactive Online email-enabled cPanel hosting and domains whose mail is sent by Google Workspace, Microsoft 365 or another authorized provider. Each sender can use a different selector. A cPanel-generated public key cannot authenticate Google, Microsoft or a marketing service unless that sending system is configured to use the corresponding signing key.

1. Get the correct public record from the sender

1. cPanel-hosted outgoing mail: open Email > Email Deliverability > Manage for the domain. Inspect the DKIM section and its suggested public Name and Value. Where offered, a local key-generation action is for the hosting server's signer; do not regenerate an established key merely because another service is failing.
2. Google Workspace: an appropriately authorized administrator opens Apps > Google Workspace > Gmail > Authenticate email, chooses the domain and uses the available generation/setup controls. Obtain the exact selector and public TXT value. After DNS publication, return to complete the signing activation/verification step.
3. Microsoft 365: open the domain's DKIM setup in the Defender portal's email-authentication settings. Copy both current CNAME names and targets shown for that domain, publish them, then enable signing as instructed. Do not reconstruct the targets from an old example; Microsoft documents changed target formats.
4. Another sender: use its domain-authentication or DKIM instructions. Confirm the selected domain, required record type, selector and all supplied records.

Understand the name and record type

For a fictional selector tutorial and signing domain example.com, the public lookup name is tutorial._domainkey.example.com. The selector is shown as s= and the signing domain as d= in a message's DKIM-Signature.

Some senders supply a TXT public key; others supply CNAMEs pointing to their managed key service. Publish the requested type. Do not create TXT and CNAME at the same exact selector name. Several different selectors can coexist for different services or a controlled rotation.

2. Publish without replacing unrelated keys

1. Our cPanel is authoritative: for its own signer, review the public suggestion and available installation/repair control. To publish an external sender's records, use Domains > Zone Editor > Manage for the exact domain, then add or edit the requested TXT or CNAME.
2. Cloudflare is authoritative: open the domain's DNS > Records. Add or edit the exact selector record, select the supplied type, enter its value, and save. Keep a DKIM CNAME DNS only. A TXT public key has no proxy toggle.
3. Another provider is authoritative: use its TXT/CNAME editor as described in the overview. Enter a relative selector prefix or full name according to that editor's rules. Do not append the domain twice.
4. Copy a long key in full. Follow the DNS provider's documented quoted-string or automatic-splitting behavior, preserving one logical key value. Do not copy a shortened display, insert line breaks into the key, or publish a private-key block.
5. Return to the sending service and complete its enable/verify action when required. Publishing DNS alone does not prove signing is active.

3. Verify a new message

For the fictional selector above, these read-only DNS examples inspect the relevant public records:

nslookup -type=TXT tutorial._domainkey.example.com
nslookup -type=CNAME tutorial._domainkey.example.com

Use the selector and domain supplied by your actual sender. If the provider uses CNAME, verify its target and the provider's final public key. Then send a fresh controlled message through that exact service. Inspect its DKIM-Signature and the receiving system's dkim=pass result. Compare the signing domain with the visible From domain for DMARC alignment.

Troubleshooting and rotation

• No signature: confirm sending used the expected service and signing is enabled there. A public DNS key cannot add a signature to an unsigned message.
• Selector not found: compare the signature's s=/d= pair with the exact published name. Check authoritative DNS, doubled domain suffixes and caches.
• Key or signature mismatch: compare the full current public key or CNAME with the service's instructions. Also check whether an intermediary changed signed content.
• DKIM passes but DMARC fails: a valid signature from the vendor's unrelated domain may not align with your From domain. Enable that service's supported custom-domain authentication.
• One sender works, another fails: inspect each service's own selector and signing setup. Preserve valid selectors belonging to other legitimate senders.

For rotation, use the sending provider's supported process, publish the new public record before it is needed, verify newly signed mail, and retain old verification material for the provider's recommended overlap period. A key replacement can affect queued messages. Keep a recovery record and ask support before altering an established cPanel key.

When to contact support

Contact Interactive Online if your email-enabled hosting service, cPanel controls, DNS authority or suggested cPanel sender values are unclear. Include the domain, exact error, affected sending service, time and time zone, and redacted authentication results or bounce details. Use a sample screenshot when possible. Keep passwords, cookies, private signing keys and API tokens out of the ticket. For Google Workspace, Microsoft 365 or another sender, obtain that service's current authentication values from its administrator. We can help identify the hosting side; access to your external DNS or email account is separate.

Related help

• Authentication overview and DNS-provider paths
• Authorize all senders in SPF
• Check DMARC alignment
• Collect redacted evidence for missing mail
• Authenticate Shopify notification senders

Official references

• DKIM signing domains, selectors and public keys
• Updated DKIM cryptographic requirements
• cPanel public DKIM record and key controls
• Google Workspace generation and activation
• Microsoft 365 current CNAME values and activation
• Cloudflare email DNS records

Content and primary-source review by Interactive Online: November 2, 2026. Provider documentation and applicable standards were reviewed. DNS records, signing keys and mail settings were not changed for this article. Menu names and available controls depend on your account, theme and permissions.