Email authentication can get confusing when you’re setting up DKIM for your domain. Your email service provider may ask you to publish a TXT record, while another may provide a CNAME record. Both serve the same purpose, but the way they work and how you manage them are different.<\/p>\n\n\n\n
If you’re wondering whether to use a DKIM CNAME or TXT record, the answer depends on your email setup, the level of control you need, and how your email service provider manages DKIM keys. Choosing the right record can make email authentication easier to manage and help you avoid DNS configuration issues.<\/p>\n\n\n\n
In this blog, we’ll explain how DKIM CNAME and TXT records work, their advantages and limitations, and the key differences between them. We’ll also help you understand which option makes more sense for your email authentication setup.<\/p>\n\n\n\n
A DKIM TXT record is a DNS record that contains the public key used to verify an email’s DKIM signature<\/a>. It is one of the most common ways to publish DKIM keys. When you set up DKIM using a TXT record, your email service provider or mail server generates a DKIM key pair. You use the private key to sign outgoing emails, while you publish the public key in your domain’s DNS as a TXT record.<\/p>\n\n\n\n When a receiving mail server gets an email, it checks the DKIM-Signature header to find the domain and DKIM selector<\/a> used to sign the message. It then performs a DNS lookup to retrieve the public key. The receiving server uses this public key to verify the signature. If the signature is valid, it confirms that the message has not been altered in a way that breaks the signature and that the signer had access to the corresponding private key.<\/p>\n\n\n\n A DKIM TXT record is published under a specific hostname that follows this format: selector._domainkey.example.com<\/p>\n\n\n\n Here:<\/p>\n\n\n\n A typical DKIM TXT record looks like this:<\/p>\n\n\n\n google._domainkey.example.com<\/em><\/p>\n\n\n\n Type: TXT<\/em><\/p>\n\n\n\n Value: v=DKIM1; k=rsa; p=PUBLIC_KEY<\/em><\/p>\n\n\n\n The record contains several tags:<\/p>\n\n\n\n **The actual public key is a long string of characters, so the example above uses a placeholder<\/p>\n\n\n\n A DKIM TXT record can be useful in a few ways, especially if you manage your own email setup.<\/p>\n\n\n\n A DKIM TXT record gives you more control over how you manage your DKIM keys. You can choose the key length, use different selectors, and decide when to update your keys based on your security needs.<\/p>\n\n\n\n For example, if you use different mail servers, you can assign separate selectors to each one. This makes it easier to manage your DKIM setup without mixing up the keys.<\/p>\n\n\n\n With a DKIM TXT record, you publish the public key directly in your domain’s DNS. You don’t have to depend on another provider’s DNS to make the key available for verification.<\/p>\n\n\n\n This can be helpful if you want to keep your email authentication setup under your own control. Your team can also review and manage the record along with your other DNS settings.<\/p>\n\n\n\n If you’re running your own mail server, a DKIM TXT record can be a practical choice. It lets you configure DKIM based on how your email system works, rather than relying on a third-party email service’s setup.<\/p>\n\n\n\n This is especially useful for businesses with custom email configurations. Your team can adjust the DKIM setup as needed without following a standard provider-managed configuration.<\/p>\n\n\n\n The main drawback is that key management can become a manual task. When you need to rotate a DKIM key, you must ensure that the new public key is published correctly and that your mail server uses the matching private key. If you remove the old key too early or configure the new record incorrectly, DKIM verification may fail.<\/p>\n\n\n\n Managing multiple domains and email services can also complicate this process. For this reason, a DKIM TXT record may not be the easiest option for businesses that want their email provider to handle key management automatically.<\/p>\n\n\n\n A DKIM CNAME record works differently from a TXT record. Instead of storing the DKIM public key directly in your domain’s DNS, it points to another domain that hosts the public key.<\/p>\n\n\n\n CNAME stands for Canonical Name. It is a DNS record that allows one hostname to act as an alias for another hostname. When you use a DKIM CNAME record, your email service provider gives you a CNAME hostname and its target value. You add these details to your DNS, and the receiving mail server follows the CNAME to find the actual DKIM public key. The provider usually stores the key as a TXT record on its DNS server.<\/p>\n\n\n\n Let’s say your domain is example.com, and your email service provider asks you to create the following CNAME record:<\/p>\n\n\n\n Host:<\/em><\/p>\n\n\n\n mail1._domainkey.example.com<\/em><\/p>\n\n\n\n Type:<\/em><\/p>\n\n\n\n CNAME<\/em><\/p>\n\n\n\n Points to:<\/em><\/p>\n\n\n\n mail1.example.dkim.emailprovider.com<\/em><\/p>\n\n\n\n Here, mail1._domainkey.example.com is the hostname used for your DKIM lookup. Instead of storing the public key at this location, the CNAME record points the lookup to mail1.example.dkim.emailprovider.com.<\/p>\n\n\n\n The receiving mail server follows this alias and retrieves the DKIM public key from the provider’s DNS.<\/p>\n\n\n\n The process looks like this:<\/p>\n\n\n\n The key difference is that you do not need to publish or manually update the public key yourself.<\/p>\n\n\n\n DKIM CNAME records can make email authentication easier to manage, particularly when you use third-party email services.<\/p>\n\n\n\n With a DKIM CNAME record, your email service provider can update the public key on its end without asking you to change the DNS record every time. This makes key rotation less of a hassle, especially if your provider handles it automatically.<\/p>\n\n\n\n You don’t have to keep track of every key update or worry about publishing a new public key yourself. Your provider takes care of the process, as long as the CNAME points to the correct hostname.<\/p>\n\n\n\n If your business uses multiple domains for sending emails, managing DKIM records for each one can get complicated. CNAME records make this process easier by letting your email provider handle the DKIM keys for different domains.<\/p>\n\n\n\n For example, if you use separate domains for marketing emails and customer support, you can configure the required CNAME records for each domain. This makes it easier to manage email authentication without handling every public key separately.<\/p>\n\n\n\n DKIM public keys can be quite long, and even a small mistake while copying or pasting one can cause authentication failures. With a CNAME record, you only need to add the hostname and target value provided by your email service.<\/p>\n\n\n\n This makes the setup less complicated and reduces the chances of entering an incorrect public key. It can be particularly helpful if you’re configuring DKIM for several email services at once.<\/p>\n\n\n\n While DKIM CNAME records make key management easier, there are a few limitations you should be aware of.<\/p>\n\n\n\n Your email service provider manages the public key on its own DNS infrastructure. This means you cannot directly change or manage the key yourself. If you need to make changes to the DKIM configuration, you’ll have to depend on your provider to handle them.<\/p>\n\n\n\n CNAME records need to be added exactly as your email service provider instructs. If you enter the wrong target hostname, use an incorrect selector, or make a mistake while configuring the record, receiving mail servers may not be able to find the DKIM public key. This can cause DKIM authentication to fail.<\/p>\n\n\n\n A CNAME record cannot be published alongside other record types at the same hostname. For example, you cannot have both a DKIM TXT record and a CNAME record at mail1._domainkey.example.com. If you need to use both record types, you must configure them under different hostnames.<\/p>\n\n\n\n Both DKIM CNAME and TXT records help receiving mail servers retrieve the public key required for email authentication. However, they differ in how they publish and manage the key.<\/p>\n\n\n\n Here’s a quick comparison:<\/p>\n\n\n\n The choice between a DKIM CNAME or TXT record depends mainly on your email service provider and how you want to manage your email authentication setup.<\/p>\n\n\n\n There is no universal answer. Some providers require CNAME records, while others ask you to publish a TXT record. You should always follow the configuration instructions provided by your email service.<\/p>\n\n\n\n Here’s when each option makes sense.<\/p>\n\n\n\n A DKIM TXT record is a good choice if:<\/p>\n\n\n\n For example, Google Workspace uses DKIM TXT records for its standard DKIM configuration. Google provides the TXT record hostname and public key, which you need to publish in your domain’s DNS.<\/p>\n\n\n\n Once the record is published, you can start DKIM authentication through the Google Admin console.<\/p>\n\n\n\n However, you should not choose TXT records simply because they give you more control. If your email provider manages DKIM automatically, manually publishing a public key may create unnecessary work or even cause configuration issues.<\/p>\n\n\n\n A DKIM CNAME record is a better choice if:<\/p>\n\n\n\n For example, Microsoft 365 uses CNAME records to connect your domain’s DKIM selectors to Microsoft’s DKIM infrastructure.<\/p>\n\n\n\n Microsoft provides the required CNAME records, which you need to publish in your DNS. Microsoft then manages the DKIM keys and their rotation. If you’re using Microsoft 365, creating a TXT record instead of the required CNAME record will not work for its standard custom-domain DKIM setup. <\/p>\n\n\n\n The same principle applies to other email service providers. If they provide CNAME records for DKIM, use those records rather than trying to create your own TXT record.<\/p>\n\n\n\n No. You cannot publish a CNAME record and a TXT record at the same hostname because DNS rules do not allow a CNAME record to coexist with other record types at the same hostname.<\/p>\n\n\n\n However, you can use TXT and CNAME records for different DKIM selectors within the same domain.<\/p>\n\n\n\n For instance, your marketing email service may use a CNAME record, while your internal mail server uses a TXT record under a different selector. This is perfectly acceptable, as long as each selector is configured correctly and your email service uses the matching private key to sign messages.<\/p>\n\n\n\n After adding your DKIM TXT record, it’s worth checking whether the record is published correctly. A small mistake in the record value or selector can cause verification issues. Use EasyDMARC’s DKIM Lookup tool<\/a> to check your DKIM configuration. Enter your domain name and the selector used by your email service. The tool will look up the record and help you identify any configuration issues. If the record is missing or invalid, check your DNS settings and compare them with the values provided by your email service. This helps you catch errors before they affect your outgoing emails.<\/p>\n\n\n\n DKIM CNAME and TXT records serve the same purpose: they help receiving mail servers retrieve the public key required to verify your email’s DKIM signature.<\/p>\n\n\n\n The main difference lies in how the public key is published and managed.<\/p>\n\n\n\n A DKIM TXT record is suitable for organizations that want direct control over their public keys and are comfortable managing DKIM configuration manually. A DKIM CNAME record is often more convenient for businesses that rely on third-party email services and want their providers to handle key management.<\/p>\n\n\n\n If you’re unsure which one to use, check your email service provider’s DKIM setup instructions. If it provides a TXT record, publish the TXT record. If it provides a CNAME record, use the CNAME record.<\/p>\n\n\n\n Most importantly, make sure your DKIM configuration works alongside SPF and DMARC. These three email authentication protocols work together to help protect your domain against email spoofing and improve trust in your outgoing emails.<\/p>\n\n\n\nHow Does a DKIM TXT Record Work<\/strong><\/h3>\n\n\n\n
\n
\n
Advantages of Using a DKIM TXT Record<\/strong><\/h2>\n\n\n\n
Greater Control Over DKIM Keys<\/strong><\/h3>\n\n\n\n
Less Dependence on External DNS Hosting<\/strong><\/h3>\n\n\n\n
Suitable for Custom Email Setups<\/strong><\/h3>\n\n\n\n
Limitations of DKIM TXT Records<\/strong><\/h2>\n\n\n\n
What is a DKIM CNAME Record?<\/strong><\/h2>\n\n\n\n
How a DKIM CNAME Record Works<\/strong><\/h3>\n\n\n\n
\n
Advantages of Using a DKIM CNAME Record<\/strong><\/h2>\n\n\n\n
Easier DKIM Key Management<\/strong><\/h3>\n\n\n\n
Simplifies Email Authentication for Multiple Domains<\/strong><\/h3>\n\n\n\n
Reduces the Risk of Manual Errors<\/strong><\/h3>\n\n\n\n
Limitations of DKIM CNAME Records<\/strong><\/h2>\n\n\n\n
Less Control Over DKIM Keys<\/strong><\/h3>\n\n\n\n
Incorrect DNS Configuration Can Cause Failures<\/strong><\/h3>\n\n\n\n
Cannot Coexist With Other DNS Record Types<\/strong><\/h3>\n\n\n\n
DKIM CNAME vs. TXT Record: Key Differences<\/strong><\/h2>\n\n\n\n
Feature<\/strong><\/td> DKIM TXT Record<\/strong><\/td> DKIM CNAME Record<\/strong><\/td><\/tr> Public key location<\/strong><\/td> Published directly in your DNS<\/td> Hosted by your email provider<\/td><\/tr> Key management<\/strong><\/td> Usually managed manually<\/td> Often managed by the provider<\/td><\/tr> Control<\/strong><\/td> More direct control<\/td> Less direct control<\/td><\/tr> Setup<\/strong><\/td> Requires publishing the public key<\/td> Requires publishing a CNAME target<\/td><\/tr> Key rotation<\/strong><\/td> May require DNS updates<\/td> Can be handled automatically by the provider<\/td><\/tr> Third-party dependency<\/strong><\/td> Lower for DNS key hosting<\/td> Depends on the provider’s DNS<\/td><\/tr> Best suited for<\/strong><\/td> Self-hosted email and custom setups<\/td> Managed email services<\/td><\/tr> Common use case<\/strong><\/td> Google Workspace TXT configuration<\/td> Microsoft 365 DKIM configuration<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n DKIM CNAME or TXT Record: Which One Should You Use?<\/strong><\/h2>\n\n\n\n
When Should You Use a DKIM TXT Record?<\/strong><\/h3>\n\n\n\n
\n
When Should You Use a DKIM CNAME Record?<\/strong><\/h3>\n\n\n\n
\n
Can You Use Both DKIM CNAME and TXT Records?<\/strong><\/h2>\n\n\n\n
How to Check If Your DKIM TXT Record Is Correct<\/strong><\/h2>\n\n\n\n
Final Thoughts<\/strong><\/h2>\n\n\n\n