SentraDMARC

DKIM and selectors

DKIM adds a signature to each message. The server that sends the message signs it with a private key; receivers fetch the matching public key from DNS at <selector>._domainkey.example.com and check the signature. The s= tag in the signature names the selector.

Who holds the key

Signing happens when the message is sent, so only your mail provider (Google Workspace, Microsoft 365, SendGrid, your own server…) can hold the private key. SentraDMARC holds no keys and signs nothing. On Business and above we host the public record your provider issued, at the selector it signs with, and grade it.

Connecting your DKIM

  1. Turn on DKIM at your provider first. Each provider shows a DKIM record: a CNAME target, or a TXT key.
  2. On the DKIM page, press Scan my domain to read the DKIM your domain already publishes, or pick your provider under Or add it by hand and paste the value. Then press Publish these records.
  3. Under Add these on your domain, the page shows one CNAME per selector, such as selector1._domainkey pointing at dkim-selector1.[your-unique-link]. Add each at your DNS host. Whatever sits at that name today (your provider's TXT key, or a CNAME straight to them) has to be removed first: a CNAME cannot share a name with another record.

Adding a selector later is the same: it is a new name on your domain, so it needs one more CNAME.

Rotation depends on your provider

  • Providers that issue a CNAME (Microsoft 365, SendGrid, Amazon SES, Postmark, Mailchimp, HubSpot, Salesforce, Klaviyo) rotate their own key behind that target. Once the CNAME is in place, nothing changes on your side.
  • Providers that issue a TXT key (Google Workspace, Zoho Mail) do not rotate it for you. To change the key, generate a new one in your provider's console and paste it on the DKIM page. Using a new selector for the new key lets the old one keep verifying mail already in flight.

What the grade checks

  • whether a selector resolves at all;
  • key strength: a 2048-bit key or stronger scores fully, a 1024-bit key is flagged as weak;
  • the t=y testing flag, which tells receivers to ignore failures;
  • syntax faults in the record.

Rotating a key on your own mail server

If you run your own server, rotate with two selectors so mail is never unsigned:

  1. Generate a new key pair under a new selector (for example key2) and publish its public key, or add it as a second selector on the DKIM page. Keep signing with the old one.
  2. Wait for the new record to be visible: at least the TTL of the record, a day if you do not know it.
  3. Switch your server to sign with key2. Once your DMARC reports show only key2 signatures, retire the old selector.