DKIM in cPanel: how to enable and check the DKIM record

In short: DKIM adds a digital signature to every message your domain sends. The receiving server compares it with a public key published in your DNS as a TXT record; if they match, it knows the mail really comes from your domain and was not changed on the way. In cPanel you check and fix DKIM under Email, then Email Deliverability.

Without a valid DKIM record, Gmail, Outlook and other providers trust your messages less and send them to Spam more often. DKIM works together with SPF and DMARC, explained in SPF and DMARC for your domain.

Step 1. See whether DKIM already works

1. Log in to cPanel and open Email, then Email Deliverability.
2. Find your domain in the list. If cPanel reports no problems, DKIM and SPF are in order and you need to do nothing.
3. If a problem is shown, continue with the next step that matches your situation.

Step 2a. DNS is at TopHost: let cPanel fix it

This is the case when the domain uses the nameservers ns4.tophost.md and ns5.tophost.md.

1. Click Manage next to the domain.
2. In the DKIM section, cPanel shows the record it expects. Click Install the suggested record.
3. Go back to the list. The Repair button next to the domain fixes DKIM and SPF in one go, if you prefer.

The record is placed in your DNS zone under the name default._domainkey.example.md.

Step 2b. DNS is with another provider

If the domain is on Cloudflare or on your registrar's DNS, cPanel cannot write the record itself.

1. In Email Deliverability, click Manage and copy the name and the full value of the suggested DKIM record.
2. In your DNS provider's panel, create a TXT record with exactly that name and value.
3. Wait for the change to spread, then check the status again in cPanel.

Mail hosted by another service

When your mailboxes are with Google Workspace, Microsoft 365 or a similar service, that service signs the mail with its own key. Generate DKIM in its admin console and add the record it gives you (a TXT, sometimes a CNAME) in Zone Editor, as described in TXT records in cPanel.

Several DKIM records can exist at the same time, because each one has its own name (selector). Keep default._domainkey if your website or forms still send mail through the TopHost server.

Step 3. Test a real message

• Send a message to the address shown on mail-tester.com and read the DKIM line of the report.
• Or send a message to a Gmail address, open it, choose Show original and look for DKIM: PASS.
• You can also look up the key directly: nslookup -type=TXT default._domainkey.example.md

New or changed DNS records are usually visible within a few hours and at most within 24 to 48 hours.

When the check still fails

• The key was cut off. DKIM values are long; copy them in full, without line breaks or added spaces.
• Two different keys under the same name. Keep only the one that matches the server that sends the mail.
• The record was added in cPanel, but DNS is elsewhere. It must be created at the provider that runs your nameservers.
• Mail is sent from a site through another SMTP service. That service needs its own DKIM setup.

If DKIM still fails after 48 hours, open a ticket with the domain and, if possible, the headers of a test message.

Related articles

• SPF and DMARC for your domain
• Recipients find your emails in Spam
• TXT records in cPanel