DKIM Setup Guide for Custom Domain Email

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outbound messages. Receivers look up your public key in DNS (a TXT at a selector hostname) to verify the message was authorized and unaltered.

MailShrine shows the exact selector host and value for your domain — you paste; you do not invent keys.

Real-life example: River Labs

Nnamdi published SPF but skipped DKIM. Outlook still quarantine-tagged cold outreach. Adding the MailShrine DKIM TXT flipped signature checks to pass within an hour.

DKIM pieces

Pair with SPF + DMARC for modern authentication (difference).

What you need

DNS access + MailShrine domain in Verified/pending flow + patience for TXT TTL.

Step 1: Open Domains → authentication

Find the DKIM host + value for your domain.

Step 2: Add TXT at the registrar

Host = selector name MailShrine shows (not always @). Value = full key string. Cloudflare: DNS only.

Step 3: Avoid truncating the key

Some panels wrap long TXT — use their multi-string/quote rules carefully so the key is complete.

Step 4: Start / wait for verification

MailShrine rechecks as DNS propagates (timing).

Step 5: Send a signed test

Inspect “Show original” / headers for dkim=pass.

Checklist

• Selector TXT publishedCompleted
• Key not truncatedCompleted
• Verification progressingCompleted
• Header shows dkim=passCompleted

Common mistakes

1. Putting DKIM on @ when selector needs something._domainkey.
2. Multiple overlapping selectors from abandoned hosts.
3. Expecting DKIM alone to fix spam — still need SPF/DMARC and good content (spam guide).

Next steps

• SPF · DMARC · Setup

Citations & References

• Reference: Google: Email sender guidelines
• Reference: Cloudflare Learning Center: DNS records
• Reference: ICANN: What is DNS?

Written by Marcus T., Email Authentication Specialist. Marcus walks teams through DKIM selectors without breaking existing DNS.