Signing your outgoing mail.
WHAT IT DOES
Your server signs outgoing mail cryptographically. Receivers verify the signature against a public key published in DNS.
It proves the message was authorised and not altered in transit.
WHERE THE RECORD GOES
A TXT record at a specific name, usually default._domainkey.yourdomain.com.
The name is determined by the selector, which the signing system chooses.
GETTING THE VALUE
cPanel > Email Deliverability generates it and shows exactly what to publish.
For an external sending service, they provide their own.
ENTERING IT
Exactly as given. The value is a key and a single altered character makes it invalid.
Some interfaces split long values; follow their instructions.
IF YOUR DNS IS OURS
cPanel can install the record automatically. Use that rather than copying by hand.
IF YOUR DNS IS EXTERNAL
Copy the record to the external provider. cPanel will report it as missing until you do.
MULTIPLE SENDERS
Each signing service uses its own selector, so several DKIM records can coexist without conflict.
Unlike SPF, there is no one-record restriction.
CHECKING
Email Deliverability reports whether it is valid.
