Walkthrough · Intermediate · 10 minutes
How to Set Up DKIM Signing
Cryptographically sign outgoing mail so spoofing and tampering both surface — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
The job: cryptographically sign outgoing mail so spoofing and tampering both surface. Time to set aside: 10 minutes. Skill needed: intermediate.
Below is the full run of steps, the error most people trip over, and the short cut worth remembering. On Hosting & Domains plans several steps are already automated away — the guide marks each one.
By the Hosting & Domains team · Reviewed 18 August 2026
Intermediate
Experience required
5
Stages, start to finish
Free
Support included
Proven
On the platform itself
No technical background needed. This walkthrough was written for first-timers, proven on our own hardware, and honest about which parts are genuinely tricky rather than merely unfamiliar.
A promise before step one: nothing here is a one-way door. Any step with teeth is flagged, and the way back is printed beside it.
The whole job in one view
The work falls into a few clean stages: switch dkim on from the panel, publish the selector record, do it again for each sending service, check the signature end to end and then leave the keys alone.
Every stage is a few minutes of unhurried clicking — the total depends mostly on how well you already know the control panel. The detailed instructions are further down; read the whole path once before you begin.
Where it comes off, and how to stay on
Switching DKIM on in the panel while DNS answers from somewhere else entirely. Mail goes out signed, pointing at a public key nobody can fetch, so every check comes back 'key not found' until the record is published where it belongs.
Forewarned is genuinely forearmed here. This one mistake accounts for most of the frustration the topic ever causes — and it disappears entirely once somebody points it out.
The habit that keeps this easy for good
DKIM survives forwarding, which is exactly where SPF gives up. That is why both exist: the signature travels inside the message, whereas SPF only ever judges the server making the last handoff.
A minute spent now repays itself every time this job comes round again — and like almost every hosting job, come round it will.
What a Hosting & Domains plan spares you
Some steps in this guide exist only because hosting traditionally forced them on you. Here the SSL issues itself, the copy is taken daily without being asked, and one-click installers remove the manual setup. What is left is the part that was always genuinely yours.
Should a step still misfire, support answers at any hour with an actual fix rather than a knowledge-base link and a shrug. Half the guides on this site began as repeat patterns in our ticket queue.
Why this job is shorter on our plans
Tutorials written against imaginary hosting go stale fast. Ours are written against the real thing: the same panel, installer and defaults waiting in your account.
Mailboxes at your own name are part of the plan — mail is included, not sold back to you at the checkout.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
Jargon never charges you
Every term is defined on the spot or linked to the jargon buster — nothing assumes prior knowledge.
Taken from real tickets
These guides came out of the support queue, so every snag flagged is one people genuinely hit.
5 steps, nothing padded
Each stage is a few minutes of steady clicking, and the fiddly moments are labelled fiddly.
Help that keeps your hours, not ours
Stuck on step three at midnight? Support answers at any hour, mid-walkthrough included.
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
The dull parts automated
SSL, backups and installs look after themselves here, leaving the guide to cover only what is genuinely yours.
Quick Start
Order placed to site online
- 1
Switch DKIM on from the panel
cPanel's Email Deliverability screen creates the key pair and shows the exact DNS record needed. On our hosting it is often no more than a single Install button.
- 2
Publish the selector record
The public half of the key goes in a TXT record at selector._domainkey.yourdomain. With DNS hosted here the panel writes it for you; hosted elsewhere, you add it by hand.
- 3
Do it again for each sending service
Newsletter platforms and CRMs sign with keys of their own and issue their own selector records, often as CNAMEs. Add each one alongside the rest, since they coexist without any friction.
- 4
Check the signature end to end
Send to a mail-testing service, or read the headers on a message delivered to Gmail. What you are looking for is dkim=pass carrying your own domain rather than somebody else's.
- 5
Then leave the keys alone
DKIM keys are not passwords needing anxious rotation. Replace them on a compromise or a provider move, not on a calendar that keeps breaking alignment for no gain.
Built In
Fitted to every plan
- Upgrades applied in place, with no migration when you change plan
- WordPress and 400+ further applications installed in one click
- Your existing site brought across by our engineers, at no charge
- SSH, Git and Composer on the developer plans
- Softaculous included for one-click application installs
- Money back within 30 days on hosting plans, 7 on reseller
- No set-up charge at any point, and no joining fee
- Webmail in the browser plus IMAP, POP and SMTP for any client
- 99.9% uptime as the target, watched around the clock
- A renewal figure identical to the one you registered at
Frequently Asked
The questions that come up most
What does DKIM change for recipients?
Nothing for the person reading the message, and everything for the filters standing in front of them. A dkim=pass aligned with your domain builds sender reputation and supports DMARC enforcement. Its absence shows up as the spam folder.
Does each service sending as me need its own DKIM?
It does. Each sender signs independently under its own selector, and several selectors sit side by side without trouble. The aim is for every legitimate mail stream to carry a signature receiving servers can verify.
Does hosting include mail?
Yes — every hosting plan includes mailboxes at your own name, with webmail, IMAP, POP and SMTP plus spam filtering on from the start. There is standalone email hosting too, for a name whose website lives somewhere else.
Where does the hardware physically sit?
The platform runs from a London datacentre with redundant power, cooling and several upstream carriers, with server-level caching in front that keeps cached pages quick for visitors anywhere. For most sites how the platform is built — NVMe disks, LiteSpeed, restrained account density per machine — counts for far more than where it sits.
Keep reading
How to Set Up Browser Caching
Teach browsers to keep your assets, so a return visit is almost instant — intermediate level, about 15 minutes.
How to Install WordPress
Have WordPress live and answering on your domain within ten minutes — beginner level, about 10 minutes.
DKIM (DomainKeys Identified Mail) (Glossary)
A single term without the jargon: what it means, why it counts, and where it catches people out.
Domain Names
Find, register and transfer names — year one free with annual hosting.
WordPress Hosting
WordPress looked after for you — LiteSpeed caching, staging copies and a daily backup.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
Register it, then build on it.
Every plan carries the essentials other hosts bill as extras — and support that answers.
View Domain Names plans