Description

Ensure the zone has a DKIM TXT record (named <selector>._domainkey) that contains a valid public key published by your email provider. Receiving mail servers use this key to check that messages signed by your domain were not changed in transit.

Rationale

Without DKIM, receiving servers cannot verify that email claiming to come from your domain was really sent by you and was not tampered with. This makes spoofing and phishing using your domain easier and can hurt email delivery. DKIM is also needed for DMARC to work well.

Impact

  • Receiving servers can verify your email signatures

  • Improves email deliverability

  • Helps protect your domain from spoofing when combined with SPF and DMARC

Default Value

By default, no DKIM record exists. Your email provider supplies the selector and public key to publish.

Pre-Requisites

  • Cloudflare account with Administrator or DNS permissions for the zone

  • The DKIM selector and public key from your email provider (for example, Google Workspace or Microsoft 365)

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Filter by Type TXT and look for a record named <selector>._domainkey whose content starts with v=DKIM1 and includes p= followed by a key.

  5. Alternatively, run: dig TXT <selector>._domainkey.<your-domain>

  6. If no valid DKIM record exists, follow the implementation steps.

Implementation Steps

  1. In your email provider's admin console, generate or copy the DKIM record (selector and public key).

  2. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  3. Select your account and the domain (zone) you want to review.

  4. Go to DNS > Records.

  5. Select Add record, choose Type TXT, enter the Name <selector>._domainkey and paste the value from your provider as the Content, and select Save.

  6. In your email provider, start DKIM signing and confirm it validates.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Select Edit on the DKIM record and restore its previous value, or delete it if it was added by mistake.

Reference