Short answer: DKIM is a DNS record that lets other mail servers check a message really came from your domain and was not altered on the way. The record is different for every domain. Copy yours from cPanel. There is no single DKIM value that every HSJ Host customer shares.
The mail server signs outgoing messages with a private key. The public half of that key is what you publish in DNS. The receiver compares the two. If the message was changed after it was signed, or the DNS key belongs to a different server, the check fails. That is why a key copied from another domain, or a key that was retyped and shortened, will not pass.
Where to copy the DKIM record
- Open cPanel from the client portal.
- Go to Email Deliverability.
- Choose Manage next to the domain.
- Copy the DKIM name and the DKIM value cPanel shows. Add that TXT record at the company that hosts your DNS.
You need both fields. The name usually contains _domainkey. The value is a long string. Paste them. Do not retype the value, do not add spaces or line breaks, and do not trim it to make it fit a screenshot. If the DNS panel has a separate field for the record type, choose TXT.
If the nameservers are already here
If the nameservers are already on this hosting account, cPanel can often install the record itself. On the Email Deliverability screen, use the repair or install action when it is offered. That writes the key into the zone for you. The nameserver guide covers how those nameservers are set. Installing DKIM does not change the website records.
If DNS is hosted somewhere else
If the website stays with another company, leave the nameservers where they are and paste the DKIM name and value into that company’s DNS as a TXT record. You are adding one record. You are not moving the site. The host name must match what cPanel shows, including the _domainkey part. Putting the value on @, which is where the SPF record goes, publishes it on the wrong name and the check still fails.
Some panels want the full name, such as the name ending in your domain, and some want only the part before the domain. If the record does not validate, compare it with the Manage screen. A duplicated domain on the end, like a name that contains your domain twice, is a common reason the key never matches.
How DKIM fits with SPF and DMARC
DKIM works with the SPF record and a DMARC record. SPF says which servers may send. DKIM signs the message. DMARC says what a receiver should do when those checks fail. Set SPF when you set the MX record. Copy DKIM from this domain’s Manage screen after the mailbox exists. Add a DMARC record only if the domain does not already have one.
A new key does not rewrite mail that was already sent. Send a fresh message to an outside address after DNS has updated, then check the authentication result. DKIM should pass for mail sent from this mailbox. Mail sent by a different service is signed by that service, if it signs at all. This record does not sign mail that left through someone else’s server.
If Email Deliverability still shows a problem
- The TXT record is missing at the DNS host. The Manage screen can generate a key before anyone has published it.
- The value was truncated or split into more than one TXT record by mistake. Replace it with one paste of the full value.
- The name does not match. Check
_domainkeyand check the domain has not been added twice. - DNS has not updated yet. Changes often show within an hour and can take 24 to 48 hours. Compare again before you generate a different key.
- The key from another domain was used. Go back to Manage for this domain and copy that pair again.
For the hosting login, use the HSJ Host client portal. Do not send the account password by email. Phone support is available Monday to Friday, 9 am to 9 pm AEST/AEDT, on 1800 519 724. Support tickets can be submitted 24/7.