How to Add DKIM and DMARC Records: 7 Proven Safe Steps

How to Add DKIM and DMARC Records is an important skill for website owners, developers, IT administrators, and beginners who want to improve the security and deliverability of business email. DKIM and DMARC work together with SPF to help receiving mail servers verify that email messages are authorized and have not been improperly modified.

If you send email from a custom domain such as example.com, attackers may attempt to impersonate your domain in phishing or spoofing messages. Proper email authentication helps receiving systems determine whether messages claiming to come from your domain are legitimate.

Learning How to Add DKIM and DMARC Records involves creating DNS records and configuring your email provider correctly. The exact DKIM value depends on your email service, while the DMARC record is normally published at a standardized DNS location.

This beginner-friendly guide explains How to Add DKIM and DMARC Records step by step, including what DKIM and DMARC are, how DNS records work, how to obtain DKIM information, how to publish records, how to create a DMARC policy, how to test your configuration, and how to troubleshoot common problems.

What Are DKIM and DMARC?

Before learning How to Add DKIM and DMARC Records, you should understand what these two technologies do.

DKIM, or DomainKeys Identified Mail, allows an email-sending system to attach a cryptographic signature to outgoing messages. The receiving mail server can retrieve the sender’s public DKIM key from DNS and use it to verify the signature.

DMARC, or Domain-based Message Authentication, Reporting, and Conformance, builds on email authentication mechanisms such as SPF and DKIM. It allows a domain owner to publish a policy describing how receiving systems should handle messages that fail authentication checks.

In simple terms:

SPF → Which servers are allowed to send?
DKIM → Is the message cryptographically signed?
DMARC → What should happen when authentication fails?

Learning How to Add DKIM and DMARC Records is easier when you understand that these technologies have different responsibilities.

The official DMARC specification provides detailed information about DMARC.

Why Should You Add DKIM and DMARC Records?

There are several reasons to learn How to Add DKIM and DMARC Records.

Protect Your Domain From Spoofing

Email spoofing occurs when someone sends a message that appears to come from your domain even though it was not authorized by you.

DKIM and DMARC can help receiving mail systems identify suspicious messages.

Improve Email Trust

Proper email authentication can help receiving providers distinguish legitimate messages from unauthorized messages.

Support Email Deliverability

Email authentication is an important part of modern email infrastructure. A properly configured domain gives receiving systems additional signals they can use when evaluating messages.

Receive Authentication Reports

DMARC can be configured to send aggregate reports to a specified reporting address. These reports can help domain administrators understand authentication activity involving their domain.

Protect Your Brand

If your company uses a custom domain for business email, learning How to Add DKIM and DMARC Records is an important security practice.

DKIM vs DMARC vs SPF

Beginners often confuse SPF, DKIM, and DMARC.

They are related, but they are not the same.

A simple email authentication flow looks like this:

Your Domain
    ↓
SPF + DKIM
    ↓
Email Sent
    ↓
Receiving Mail Server
    ↓
Authentication Checks
    ↓
DMARC Policy

Understanding this relationship makes How to Add DKIM and DMARC Records much easier.

What Do You Need Before Adding DKIM and DMARC?

Before starting How to Add DKIM and DMARC Records, collect the information required by your email provider and DNS host.

You normally need:

• Access to your domain’s DNS management
• Access to your email provider
• Your domain name
• DKIM selector
• DKIM public key
• Email provider’s DKIM instructions
• A mailbox for receiving DMARC reports, if reports are enabled

Your DNS provider may be:

• Your hosting company
• Your domain registrar
• Cloudflare
• A dedicated DNS provider
• Another DNS management platform

Remember that your website hosting provider and DNS provider may be different companies.

For example:

Domain Registrar → Company A
DNS → Company B
Website Hosting → Company C
Email → Company D

You need to modify DNS records wherever your domain’s authoritative DNS zone is managed.

How to Find Where Your DNS Is Managed

One important part of How to Add DKIM and DMARC Records is finding the correct DNS management interface.

Log in to your domain registrar or DNS provider.

Look for options such as:

DNS Management
DNS Records
Manage DNS
Zone Editor
DNS Zone
Domain Settings

You should see records such as:

A
AAAA
CNAME
MX
TXT

If you do not see DNS management, your domain may be using external nameservers.

You can check your domain’s nameservers using a DNS lookup tool or your registrar’s domain settings.

Do not add DKIM or DMARC records to the wrong DNS provider.

Step 1: Check Your Existing SPF Record

Before learning How to Add DKIM and DMARC Records, check your existing SPF record.

SPF is normally published as a TXT record.

It may look similar to:

v=spf1 include:example-email-provider.com ~all

Your actual SPF record depends on your email service.

Do not blindly copy an SPF record from another website.

If you already have an SPF record, do not create a second SPF TXT record for the same domain. SPF policies should generally be combined into a single SPF record.

For example, if your organization sends email through multiple legitimate services, those services may need to be included in the same SPF policy.

SPF is not the main focus of How to Add DKIM and DMARC Records, but checking it first is important because DMARC can use SPF authentication and alignment.

Step 2: Get Your DKIM Record From Your Email Provider

The exact DKIM record is normally generated by your email provider.

Do not invent the DKIM public key.

Your provider may give you information similar to:

Type: TXT
Name: selector1._domainkey
Value: v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE

Some providers may ask you to create a CNAME record instead.

For example:

Type: CNAME
Name: selector1._domainkey
Target: selector1-example-com._domainkey.email-provider.com

The exact format depends entirely on your email service.

This is why How to Add DKIM and DMARC Records cannot use one universal DKIM value.

Your email provider generates the key and tells you which DNS record to publish.

What Is a DKIM Selector?

A DKIM selector identifies which DKIM public key should be used to verify a message.

For example:

selector1._domainkey.example.com

Here:

selector1

is the selector.

Your email provider determines the selector.

Some providers use names such as:

default
selector1
selector2
google
s1
s2

Never assume your selector is default.

Use the selector provided by your email service.

Understanding selectors is an important part of How to Add DKIM and DMARC Records.

Step 3: Add the DKIM DNS Record

Open your DNS management panel.

Choose Add Record.

Select the record type specified by your email provider.

If your provider instructs you to create a TXT record, enter:

Type: TXT
Name: selector1._domainkey
Value: v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY

Some DNS interfaces automatically append your domain name.

For example, if you enter:

selector1._domainkey

the DNS system may store it as:

selector1._domainkey.example.com

Do not accidentally enter the complete hostname twice if your DNS provider automatically adds the domain.

Always follow your DNS provider’s naming format.

Step 4: Verify the DKIM Record

After publishing the DKIM record, verify that it is publicly available.

You can use DNS lookup tools to check:

selector1._domainkey.example.com

For a TXT-based DKIM record, you should see a value similar to:

v=DKIM1; k=rsa; p=PUBLIC_KEY

If your provider uses a CNAME-based DKIM configuration, you should instead see the expected CNAME target.

DNS changes can take some time to become visible depending on caching and TTL settings.

Do not immediately assume that the configuration is incorrect just because a lookup tool does not show the record immediately.

Verification is a critical part of How to Add DKIM and DMARC Records.

Step 5: Understand DMARC Before Creating the Record

The next stage of How to Add DKIM and DMARC Records is configuring DMARC.

DMARC records are published under:

_dmarc.example.com

A basic DMARC record may look like:

v=DMARC1; p=none;

The components mean:

v=DMARC1

identifies the record as a DMARC policy.

p=none

tells receiving systems that the domain owner is not requesting a quarantine or rejection action for messages that fail DMARC.

A monitoring policy is often useful when first deploying DMARC because it allows administrators to observe authentication results before enforcing a stronger policy.

The DMARC RFC provides the formal specification.

Step 6: Add the DMARC DNS Record

Open your DNS management panel and create a new TXT record.

Use:

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=none;

Depending on your DNS provider, the final hostname becomes:

_dmarc.example.com

A more complete DMARC record may include an aggregate reporting address:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

The rua tag specifies where aggregate DMARC reports may be sent.

Before using a reporting address, make sure you understand how your provider handles DMARC reports and whether the receiving mailbox is prepared for them.

Understanding DMARC Policies

When learning How to Add DKIM and DMARC Records, it is important to understand the main DMARC policy options.

p=none

This is primarily a monitoring policy.

Example:

v=DMARC1; p=none;

It does not request that failing messages be quarantined or rejected.

This can be useful during initial deployment.

p=quarantine

Example:

v=DMARC1; p=quarantine;

This requests that messages failing DMARC be treated as suspicious, such as being placed in a spam or junk folder.

p=reject

Example:

v=DMARC1; p=reject;

This requests rejection of messages that fail DMARC under the published policy.

Moving directly to p=reject without understanding your legitimate email sources can cause legitimate messages to be rejected.

Therefore, a gradual deployment is often safer.

Step 7: Test DKIM and DMARC

After completing How to Add DKIM and DMARC Records, test your configuration.

There are several ways to test email authentication.

Send a Test Email

Send an email from your domain to another mailbox.

Then inspect the received message’s authentication results.

You may see information similar to:

SPF: PASS
DKIM: PASS
DMARC: PASS

The exact display varies by email provider.

Check Email Headers

Open the message’s full headers or original message.

Look for an authentication-results header.

You may see something similar to:

dkim=pass
spf=pass
dmarc=pass

These results indicate that the receiving server successfully evaluated the authentication mechanisms.

Testing is one of the most important stages of How to Add DKIM and DMARC Records.

What Does DKIM Pass Mean?

A DKIM pass means the receiving system successfully validated the DKIM signature according to its checks.

A simplified process looks like this:

Email Sender
    ↓
Private DKIM Key
    ↓
Message Signature
    ↓
Email Sent
    ↓
Receiving Server
    ↓
Public DKIM Key From DNS
    ↓
Signature Verification

The private key stays with the sending system.

The public key is published in DNS.

Never publish the private DKIM key.

What Does DMARC Pass Mean?

A DMARC pass generally requires an aligned SPF or DKIM authentication result according to the domain’s DMARC configuration.

DMARC is about more than simply having SPF or DKIM present.

It also considers alignment between the authenticated domain and the domain visible in the message’s From header.

This is an important concept when learning How to Add DKIM and DMARC Records.

What Is DMARC Alignment?

Suppose an email displays:

From: user@example.com

DMARC evaluates whether the authenticated domains used by SPF and/or DKIM align appropriately with example.com.

For DKIM, the signing domain is associated with the d= value in the DKIM signature.

For SPF, the relevant authenticated domain is associated with the envelope sender/return-path domain.

This means an email can have a valid DKIM signature and still fail DMARC if the authenticated domain is not aligned according to the domain’s DMARC policy.

Common DKIM and DMARC Errors

When learning How to Add DKIM and DMARC Records, beginners often encounter DNS or authentication problems.

DKIM Record Not Found

If your provider cannot find the DKIM record, check:

• Selector
• DNS hostname
• Record type
• Public key
• DNS provider
• Domain spelling

For example, make sure you are checking:

selector1._domainkey.example.com

rather than:

example.com

DKIM Signature Failed

A DKIM failure may occur because:

• The public key is incorrect
• The wrong selector is published
• The DNS record is malformed
• The message was modified in transit
• The sending service is not using the expected DKIM key

Check your email provider’s DKIM configuration.

DMARC Record Not Found

Make sure the TXT record exists at:

_dmarc.example.com

not simply:

example.com

DMARC Syntax Error

A malformed DMARC record may be ignored.

For example, a basic policy should follow the correct syntax:

v=DMARC1; p=none;

Do not add unsupported tags or incorrectly formatted values.

DMARC Passes for One Provider but Fails for Another

Different email services may process authentication and forwarding differently.

Review the actual authentication results in the message headers.

Also check whether all legitimate sending services have been configured with appropriate SPF and DKIM authentication.

What Happens When You Change DMARC to Reject?

A common mistake in How to Add DKIM and DMARC Records is immediately publishing:

v=DMARC1; p=reject;

without first identifying legitimate email sources.

Suppose your company sends email through:

Company Mail
Marketing Platform
Transactional Email Service
Support Platform

Each system may use different authentication mechanisms.

If one legitimate service is not correctly authenticated and aligned, a strict DMARC policy could cause its messages to be rejected by receiving systems.

A safer deployment approach is generally:

p=none
   ↓
Monitor results
   ↓
Fix legitimate sources
   ↓
Consider quarantine
   ↓
Consider reject

The correct policy depends on your organization’s email infrastructure.

How to Add DKIM and DMARC Records for Multiple Email Services

Many organizations use multiple services to send email.

For example:

Google Workspace → Employee email
Mailing Platform → Marketing email
Application Server → Transactional email
Support Platform → Support email

Each service needs to be considered.

For DKIM, each provider may give you a different selector and public key.

You may therefore have records such as:

selector1._domainkey.example.com
selector2._domainkey.example.com
marketing._domainkey.example.com

For SPF, all legitimate sending sources need to be represented appropriately within the domain’s SPF policy, while respecting SPF’s DNS lookup limitations.

For DMARC, you generally publish one DMARC policy at the domain level.

How to Add DKIM and DMARC Records in Cloudflare

If Cloudflare manages your DNS, log in to the Cloudflare dashboard and select your domain.

Open the DNS records section.

Click Add record.

For DKIM, select the record type specified by your email provider, commonly TXT or CNAME.

For example:

Type: TXT
Name: selector1._domainkey
Content: v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY

For DMARC:

Type: TXT
Name: _dmarc
Content: v=DMARC1; p=none;

The exact Cloudflare interface may change over time, so verify the current fields in Cloudflare’s documentation.

[Internal link: How to Configure DNS Records in Cloudflare]

How to Add DKIM and DMARC Records in cPanel

If your domain’s DNS is managed through cPanel, open the DNS Zone Editor.

Depending on your hosting provider, the path may be:

cPanel → Domains → Zone Editor

Select your domain.

Add the DKIM record provided by your email provider.

Then add the DMARC TXT record:

Name: _dmarc
Type: TXT
Record: v=DMARC1; p=none;

Do not assume that your hosting provider manages DNS just because your website is hosted there.

Your authoritative DNS provider determines where the records need to be added.

How to Add DKIM and DMARC Records for Google Workspace

If you use Google Workspace, Google provides DKIM configuration information through its administration tools.

The general process involves:

1. Open the Google Admin console.
2. Find Gmail authentication settings.
3. Select your domain.
4. Generate or retrieve the DKIM record.
5. Publish the provided DNS record.
6. Return to the administrator console.
7. Start DKIM authentication.
8. Send test messages.
9. Verify authentication results.

Google’s current instructions should be followed because its administrative interface and available options can change.

See the official Google Workspace documentation for DKIM configuration.

For DMARC, Google also provides guidance on configuring domain authentication policies.

How to Add DKIM and DMARC Records for Microsoft 365

Microsoft 365 also supports DKIM and DMARC configuration.

Microsoft typically provides domain-specific DKIM CNAME records that need to be published in DNS.

The exact values depend on your Microsoft 365 domain configuration.

Follow Microsoft’s current documentation rather than using generic values from another website.

See the official Microsoft DKIM documentation for current instructions.

After DKIM is configured, you can publish a DMARC TXT record for your domain.

How Long Does DNS Take to Update?

DNS changes are not always visible immediately.

After publishing DKIM or DMARC records, DNS resolvers may continue using cached information according to the previous TTL.

The update time can range from a short period to longer depending on DNS caching, provider behavior, and previous TTL values.

Do not repeatedly delete and recreate records simply because they are not visible immediately.

Instead:

1. Confirm the record is saved.
2. Check the authoritative DNS provider.
3. Verify the hostname.
4. Check the record type.
5. Wait for DNS propagation.
6. Test again.

How to Monitor DMARC Reports

A DMARC policy can include an aggregate reporting address using the rua tag.

For example:

v=DMARC1; p=none; rua=mailto:dmarc@example.com;

Reports can provide information about authentication activity involving your domain.

However, DMARC reports can be numerous and may contain technical data that is difficult to interpret manually.

Organizations often use dedicated DMARC reporting platforms to collect, process, and visualize these reports.

Monitoring is particularly important before moving to a strict quarantine or reject policy.

DKIM and DMARC Security Best Practices

After learning How to Add DKIM and DMARC Records, follow these best practices.

Never Publish a DKIM Private Key

Only the public key belongs in DNS.

Use Your Email Provider’s DKIM Values

Never invent DKIM selectors or public keys.

Check All Legitimate Sending Services

Identify every platform that sends email using your domain.

Start With Monitoring

Use a cautious DMARC deployment strategy before enforcing a strict policy.

Review Authentication Reports

Look for unexpected sources sending messages that claim to use your domain.

Protect Your DNS Account

Use strong authentication and multi-factor authentication for your DNS provider.

Keep DNS Records Organized

Document why each DKIM, SPF, and DMARC record exists.

Common Mistakes Beginners Should Avoid

When learning How to Add DKIM and DMARC Records, avoid these common mistakes.

Creating Multiple DMARC Records

A domain should not have multiple competing DMARC policies.

The DMARC record belongs at:

_dmarc.example.com

Creating Multiple SPF Records

Do not create separate SPF TXT records for different email providers. SPF should be consolidated into a single policy for the domain.

Using the Wrong DKIM Selector

The selector must match the one used by your email provider.

Copying DKIM From Another Domain

DKIM public keys are domain/provider-specific.

Immediately Using p=reject

First identify and authenticate legitimate email sources.

Forgetting Third-Party Email Services

Marketing, CRM, support, transactional, and notification platforms may all send mail using your domain.

Adding Records to the Wrong DNS Provider

Always determine where the authoritative DNS zone is managed.

Email Authentication Checklist

Use this checklist when following How to Add DKIM and DMARC Records:

• Identify your authoritative DNS provider
• Check the existing SPF record
• Identify every legitimate email-sending service
• Open your email provider’s DKIM settings
• Obtain the correct DKIM selector
• Obtain the DKIM public key or CNAME
• Add the DKIM DNS record
• Verify the DKIM record
• Create a DMARC TXT record
• Use the correct _dmarc hostname
• Start with an appropriate DMARC policy
• Configure reporting if required
• Send test emails
• Inspect email authentication results
• Verify DKIM passes
• Verify SPF passes where applicable
• Verify DMARC passes
• Check domain alignment
• Monitor DMARC reports
• Fix legitimate authentication failures
• Consider stronger DMARC enforcement after monitoring

Frequently Asked Questions

What are DKIM and DMARC?

DKIM adds a cryptographic signature to email, while DMARC allows a domain owner to publish a policy for handling messages that fail authentication and alignment checks.

How to Add DKIM and DMARC Records to a domain?

Get the DKIM record from your email provider and publish it at the selector’s _domainkey hostname. Then create a TXT record at _dmarc.yourdomain.com with an appropriate DMARC policy.

Do I need SPF before adding DKIM and DMARC?

DKIM and DMARC can be configured independently of SPF, but a complete email authentication strategy commonly uses SPF, DKIM, and DMARC together.

Where should the DMARC record be added?

The DMARC record is normally published as a TXT record at:

_dmarc.example.com

Can I have more than one DKIM record?

Yes. Different DKIM selectors can coexist on the same domain, particularly when multiple email providers or sending systems are used.

Can I have multiple DMARC records?

You should not publish multiple DMARC policy records for the same domain. Multiple policies can create ambiguity and cause unpredictable results.

Does DKIM improve email deliverability?

Proper DKIM configuration provides receiving systems with an authentication signal. Deliverability depends on many factors, including sender reputation, content, recipient engagement, SPF, DKIM, DMARC, infrastructure, and provider-specific policies.

What does p=none mean in DMARC?

p=none is a monitoring-oriented policy. It tells receiving systems not to request quarantine or rejection based on the domain’s DMARC policy.

What does p=quarantine mean?

p=quarantine requests that messages failing DMARC be treated as suspicious, often by placing them in spam or junk handling.

What does p=reject mean?

p=reject requests that receiving systems reject messages that fail DMARC under the applicable policy.

How long does DKIM take to work after adding the DNS record?

It depends on DNS caching and your email provider. Once the DNS record is publicly visible and the provider is configured to sign messages, new messages can be tested for DKIM authentication.

Useful External Resources

For the formal DMARC specification, see the IETF RFC 7489.

For DKIM standards, see the IETF DKIM documentation.

For Google Workspace DKIM configuration, use the official Google Workspace documentation.

For Microsoft 365 DKIM configuration, see the official Microsoft documentation.

For general email authentication guidance, the DMARC.org website provides additional educational resources.

These external resources provide authoritative information that can help you understand How to Add DKIM and DMARC Records and configure email authentication correctly.

Conclusion

Learning How to Add DKIM and DMARC Records is an important step toward protecting a business domain from email spoofing and improving the reliability of domain authentication.

The basic process is straightforward: identify your DNS provider, check SPF, obtain DKIM information from your email provider, publish the DKIM record, create a DMARC TXT record, test authentication, and monitor the results.

The most important thing to remember is that DKIM and DMARC records are specific to your domain and email infrastructure. Never copy a DKIM public key from another website, and do not guess the selector provided by your email service.

When implementing DMARC, start carefully and identify all legitimate email-sending services before enforcing a strict policy. A gradual approach can help prevent legitimate business emails from being incorrectly quarantined or rejected.

Once you understand How to Add DKIM and DMARC Records, you can use DNS-based email authentication as an important part of your website and domain security strategy.