Managed DKIM selectors, without DNS copy-paste.
Centralize DKIM selector records across domains and sending services, then manage routine record changes from one dashboard after activation.
No Credit Card Required
Recognized as a Leader by Experts
Compliant with Industry Standards
90,000+ organizations trust EasyDMARC worldwide
Six DKIM problems modern email teams hit at scale.
01
DKIM selectors become difficult to inventory.
- Multiple sending services can publish different selectors and record types
- Old selector records can remain after sender or vendor changes
02
Selector ownership becomes unclear.
- DNS shows the record, but not always which service or team still depends on it
- Removing an unfamiliar selector without checking its use can break DKIM verification
03
Manual record changes can break DKIM verification.
- A wrong selector, public-key value, or CNAME target can prevent receivers from finding the correct verification record
- The impact is greater when DKIM is the aligned authentication path a sender relies on for DMARC
04
Key rotation crosses the sender and DNS.
- The sending system controls the private signing key and selector rotation
- The corresponding public selector records must remain available through the transition and be retired deliberately afterward
05
Every additional sender adds DKIM lifecycle work.
- A new email service can introduce one or more selectors and its own DKIM setup process
- Across many domains and providers, onboarding and retirement become repeated DNS operations
06
DKIM gaps can become DMARC enforcement blockers.
- DMARC can pass through aligned SPF or aligned DKIM
- When a sender relies on DKIM for alignment, a missing or broken selector can cause DMARC failure under an enforcement policy
How Hosted DKIM works.
Centralize DKIM selector records per domain, surface selectors from available DNS and DMARC evidence, add and update records through guided fields, and activate through a one-time NS delegation.
Keep managed DKIM selectors and sender context together.
See the selector, associated sending service, record type, value, and the date it was added to Managed DKIM in one view. This makes the DNS-side DKIM estate easier to understand without relying on spreadsheets or tribal knowledge.
- Per-domain managed selector inventory
- Sender context attached to each managed selector
- TXT and CNAME selector records supported
- Record value and Managed DKIM creation history visible
Surface DKIM selectors already in use.
Managed DKIM uses available DNS evidence and DMARC aggregate reports to surface selectors associated with the domain. Selectors that cannot be discovered automatically can be added manually before activation.
- Available DNS checks for known selector records
- DMARC aggregate evidence for selectors observed in mail
- Newly observed or unidentified selectors surfaced for review
- Manual entry for selectors not available through either source
Add and update selector records without editing raw DNS.
Use structured fields for the sending service, record type, selector, and value instead of manually creating DKIM records inside the authoritative DNS console.
- Identify the sending service
- Select TXT or CNAME
- Enter the selector and public-record value
- _domainkey suffix handled by the Managed DKIM workflow
- Notes to preserve operational context
Delegate _domainkey once. Manage selector records centrally afterward.
After confirming that the active DKIM selector records required by the domain are represented correctly in Managed DKIM, activate the service by publishing the supplied NS delegation for _domainkey. Receiving servers then retrieve the managed public DKIM records through the delegated DNS authority.
- Confirm active DKIM records before migration
- Publish a one-time _domainkey NS delegation
- Verify delegation and Managed DKIM activation
- Manage future hosted selector-record changes from EasyDMARC
Managed DKIM requires the DNS provider to support NS delegation at the _domainkey subdomain.
What changes when DKIM selector management is centralized.
One place to manage selector records.
- Managed selectors organized by domain.
- Sender context kept with each selector.
- Available DNS and DMARC evidence used to surface selectors.
- Guided record updates instead of routine raw DNS edits.
Reduce DNS-side DKIM mistakes.
- Structured fields for TXT and CNAME records.
- Existing records reviewed before delegation.
- Sender and selector context retained during changes.
- Public selector lifecycle managed from one workflow after activation.
Reduce DKIM blockers on the path to enforcement.
- Keep public selector records available for legitimate senders.
- Review selectors associated with sending services before enforcement.
- Support sender transitions and selector changes more deliberately.
- Maintain DKIM as a reliable aligned authentication path where it is required.
Works with the email and DNS environments you already use.
Managed DKIM centralizes the public selector records while your existing sending platforms continue signing mail. EasyDMARC provides sender-specific setup support and DNS connections to simplify the surrounding workflow.
Sender setup support
Use provider-specific DKIM setup guidance when bringing common sending services into the managed selector inventory.
Microsoft 365 
Google Workspace 
SendGrid 
Mailgun 
Mailchimp 
Amazon SES 
Salesforce ActiveCampaign + more supported sender guidesSetup guides, not native API integrations.
DNS provider connections
Connect supported DNS providers where available, or publish the Managed DKIM NS delegation manually.
Cloudflare 
AWS Route 53 
Azure DNS 
Google Cloud DNS 
GoDaddy 
Namecheap + more DNS integrationsWhat customers say.
The Managed SPF and DKIM solutions put us in a position where we can manage both very simply. When we bring on a new vendor, adding their information is straightforward, and we have a much cleaner process for maintaining those records over time.
William Olejarz
Information Security Risk Analyst at Florence Bank
What is Managed DKIM?
Managed DKIM centralizes the DNS-side public records used for DKIM verification. After a one-time _domainkey NS delegation, supported selector records are hosted and managed through EasyDMARC instead of requiring routine edits in the authoritative DNS zone. Your sending systems continue signing outgoing email with their own private keys.
What is a DKIM selector?
A DKIM selector is the s= value in the DKIM-Signature header. Together with the signing domain in d=, it tells the receiving system which public DKIM record to query, typically at selector._domainkey.example.com. Organizations using multiple sending services can therefore have multiple selectors to manage.
How does Managed DKIM activation work?
Before activation, confirm that the active DKIM selector records the domain needs are represented correctly in Managed DKIM. EasyDMARC then provides the _domainkey NS delegation to publish through the DNS provider. Once the delegation is active, receiving systems query the delegated DNS authority for the managed public DKIM records. DNS-provider support for this delegation varies.
Does Managed DKIM sign my email?
No. The sending system continues to sign outgoing messages using its private DKIM key. Managed DKIM manages the DNS-side public selector records receivers use to verify those signatures.
Does Managed DKIM rotate my DKIM keys?
Private-key generation and rotation remain with the sending system or provider. When the sender transitions to another selector or public key, the corresponding DNS-side selector records can be managed through Managed DKIM. Old public selector records should be retired only after the required transition period.
Can Managed DKIM automatically find every DKIM selector?
No system can reliably enumerate every arbitrary DKIM selector from DNS alone because selector names are not published in a universal index. Managed DKIM can surface selectors using available DNS checks and DMARC aggregate evidence, and additional selectors can be added manually.
What is the difference between Managed DKIM and Managed DMARC?
Managed DKIM centralizes DKIM selector records. Managed DMARC centralizes the DMARC policy record. They solve different parts of email authentication and can be used alongside EasySPF to manage the DNS-side records involved in SPF, DKIM, and DMARC.
Which plans include Managed DKIM?
Managed DKIM is available in Premium and Enterprise plans. Domain count and feature scope scale with the tier. Talk to sales for a quote scoped to the domain portfolio.