DKIM CNAME vs TXT Records: Which Should You Use?

When you set up DKIM with an ESP, they hand you records to add to DNS. Sometimes those records are CNAMEs pointing at the ESP's infrastructure. Sometimes they're TXT records with the public key in them. Both are valid DKIM configurations, but they behave differently for key rotation and security audits. This guide covers when each is used, what to choose if you have the choice, and how to debug DKIM lookups.

The short version: CNAME if your ESP offers it (most do), TXT if you control your own keys.

How DKIM lookups work

When a receiver gets a message signed with DKIM, they read the DKIM-Signature header for two values: the signing domain (d=yourdomain.com) and the selector (s=selector1). They then look up:

selector1._domainkey.yourdomain.com

That query returns a TXT record containing the public key. If your DNS has a CNAME at that location, the receiver follows the CNAME to the target and reads the TXT there.

selector1._domainkey.yourdomain.com.   CNAME   selector1._domainkey.youresp.net.
selector1._domainkey.youresp.net.      TXT     "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."

This is transparent to the receiver. From the verification perspective, CNAME and TXT both produce the same result: a public key the receiver uses to verify the signature.

When ESPs use CNAME

Most major ESPs default to CNAME in 2026:

ESP	DKIM record type	Notes
SendGrid	CNAME (3 records)	"Authenticated domain" setup
Mailgun	CNAME (1-2 records)	Recommended by default
Klaviyo	CNAME (2-3 records)	Dedicated sending domain feature
Mailchimp	CNAME (3 records)	"Authenticated domain"
Postmark	CNAME or TXT	Choice during setup
Resend	CNAME	Default
AWS SES	CNAME (3 records)	"Easy DKIM"
Brevo	CNAME	Default
Klaviyo	CNAME	Default for branded sending

The reason: ESPs rotate DKIM keys periodically (every 6-12 months is typical) for security. If they used TXT records, every customer would have to manually update their DNS every rotation. With CNAMEs, the ESP updates their own underlying records and customer DKIM rotates automatically.

For background on key rotation, see DKIM key rotation.

When you'd use TXT instead

You publish your own DKIM TXT record when:

1. You run your own mail server (Postfix + OpenDKIM, Mail-in-a-Box, Mailcow). The key is on your server, the public half lives in your DNS.
2. You want to pin a specific key for compliance or security audits.
3. Your ESP doesn't offer CNAME (rare in 2026, but some smaller providers).
4. You're doing third-party DKIM without a hosting relationship.

For self-hosted mail servers, a TXT record looks like:

mailserver._domainkey.yourdomain.com.   TXT   "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."

The private key stays on your server (/etc/opendkim/keys/yourdomain.com/mailserver.private for OpenDKIM). The public key goes in DNS as TXT.

CNAME vs TXT comparison

Factor	CNAME	TXT
Key rotation	Automatic via ESP	Manual
You control the key	No	Yes
Setup complexity	One record (usually)	One record
Visibility into key value	Hidden behind CNAME	Visible in DNS
Works for all ESPs	Most modern ones	All
Security audit friendly	Less	More
Risk if ESP loses key	Low (they rotate)	N/A (you own it)
Multi-ESP same domain	Yes (different selectors)	Yes (different selectors)

For most senders using an ESP, CNAME is the better operational choice. The trade-off (visibility into the exact key) doesn't matter unless you have specific compliance requirements.

DNS record limits to watch for

CNAME records have one significant restriction in DNS: a CNAME cannot coexist with any other record type at the same name. If you have a CNAME at selector1._domainkey.yourdomain.com, you can't also have a TXT at that exact name. This rarely matters for DKIM but trips people up when migrating between ESPs.

Practitioner note: When switching ESPs, set up the new DKIM records first (different selector, won't conflict), verify they work, then update the From-domain DKIM-Signature header to use the new selector before tearing down the old records. Keep the old records live for 7-14 days during transition to handle mail still in queue.

Setting up DKIM with multiple ESPs

You can run multiple ESPs signing for the same From-domain by using different selectors:

s1._domainkey.yourdomain.com.       CNAME   s1.domainkey.u1234.wl.sendgrid.net.
k1._domainkey.yourdomain.com.       CNAME   k1.domainkey.mg.yourdomain.com.
postmark._domainkey.yourdomain.com. CNAME   pm.dkim.postmarkapp.com.

Each ESP signs with its own selector. Receivers verify whichever selector matches the message's DKIM-Signature header. All three work simultaneously.

This pattern is common when you have:

• Marketing on Klaviyo
• Transactional on Postmark
• Cold outreach on Smartlead (with separate domain, ideally)

Debugging DKIM record problems

When DKIM verification fails, check in order:

1. Does the record resolve?

   dig TXT selector1._domainkey.yourdomain.com +short
   

   If empty, the record isn't published or DNS hasn't propagated.

2. Does the CNAME target exist?

   dig CNAME selector1._domainkey.yourdomain.com
   dig TXT <the CNAME target>
   

   Both should return values.

3. Is the public key valid format? The TXT should start with v=DKIM1; k=rsa; p= followed by a base64-encoded key.

4. Does the message's DKIM header match? View the raw message source, look for DKIM-Signature: ... d=yourdomain.com; s=selector1; .... The d= should be your signing domain, s= your selector.

5. Does it actually verify? Send to [email protected] or use a tool like dkimvalidator.com.

For the broader troubleshooting workflow, see DKIM verification failed.

Practitioner note: The most common DKIM failure I see isn't the CNAME vs TXT decision — it's a typo in the selector name during DNS setup. The ESP says "add a CNAME at scph0925._domainkey" and someone adds "scph0926._domainkey" because that's what they're looking at on another browser tab. dig the exact selector and verify it returns before assuming the issue is elsewhere.

If you're setting up DKIM across multiple ESPs and want help with selector strategy and rotation planning, book a consultation. I do authentication setup including multi-ESP DKIM, DMARC alignment, and key rotation schedules.

Sources

• RFC 6376 — DKIM Signatures — IETF
• SendGrid domain authentication setup — Twilio SendGrid
• Mailgun DKIM setup — Mailgun
• AWS SES Easy DKIM — AWS
• Postmark DKIM documentation — Postmark

---

v1.0 · May 2026