How to Generate DomainKeys (DKIM) Signatures for Better Inbox Deliverability

If your outgoing business emails sometimes land in recipients' spam folders, DKIM is one of the most effective, low-effort fixes available. It's a cryptographic signature added to your outgoing mail that lets receiving mail servers verify the message genuinely came from your domain and wasn't tampered with in transit. StackCP includes a straightforward DomainKeys tool to set this up.

What Is DKIM, in Plain English?

Think of DKIM as a tamper-evident seal on your outgoing mail. Your mail server signs each message with a private cryptographic key; the receiving mail server checks that signature against a public key published in your domain's DNS records. If they match, the receiving server has strong evidence the message really did come from your domain and wasn't altered along the way — a signal that meaningfully improves how trustworthy your mail appears to spam filters.

Step 1: Open the DomainKeys Tool

1. Log in to StackCP.
2. Go to Manage Hosting, then Manage on your package.
3. Select DomainKeys under the Email section.
4. Choose the correct domain from the dropdown if you manage more than one on this package.

Step 2: Understand the Configuration Fields

Before generating your signature, it's worth understanding each field you'll be asked to set:

• Selector — a custom label of your choosing (e.g., default, mail, or something date-based like october2025). This becomes part of the DNS record name and lets you run multiple DKIM keys for the same domain if ever needed (for example, during a planned key rotation).
• Granularity / Identity — by default, this is set to a wildcard (*), meaning the DKIM signature applies to all mailboxes on the domain. You can restrict it to a specific mailbox (for example, entering sales so the signature only applies to sales@yourdomain.com) if you have a specific reason to scope it that narrowly — most businesses leave this as the default wildcard.
• Service Type — currently, only 'Email' is supported, so this can be left as-is.
• Canonicalization — choose between Simple or Relaxed. Relaxed is generally the more forgiving, commonly recommended option, since it tolerates minor formatting changes a message might undergo in transit without invalidating the signature; Simple is stricter and more easily broken by small changes.

Step 3: Generate Your Signature

1. With your Selector, Granularity, Service Type, and Canonicalization set, select Add Signature.
2. StackCP generates a 2048-bit cryptographic key pair for your domain.

Step 4: Confirm the DNS Record Was Added

If your domain's nameservers are pointed to StackCP, the required TXT record is automatically added to your domain's DNS zone (viewable under Manage DNS) — no manual DNS editing needed on your part. If your nameservers are managed elsewhere, you'll need to manually add the generated TXT record to your DNS provider instead.

Step 5: Set Realistic Expectations

It's worth understanding what DKIM does and doesn't do: DKIM doesn't guarantee your mail will be delivered to the inbox — it simply gives the receiving mail server additional, verifiable information to factor into its own spam-scoring decision. Combined with SPF and DMARC (see our companion DMARC guide), it forms part of a well-rounded deliverability setup, but no single technical measure eliminates spam filtering risk entirely, particularly if other factors (like your sending reputation or message content) are also working against you.

Why This Matters for Your Business

• Improved inbox placement for legitimate outgoing mail — invoices, order confirmations, customer replies — rather than these messages landing in spam.
• Protection of your domain's reputation. Without DKIM (and SPF/DMARC), it's easier for someone else to send spoofed mail appearing to come from your domain, which can damage your domain's sending reputation over time even if you didn't send the offending mail yourself.
• A one-time setup with ongoing benefit — once configured, DKIM signs your outgoing mail automatically without any per-message effort.

Common Mistakes Beginners Make

• Not setting up DKIM at all, missing out on a meaningful, free deliverability improvement.
• Manually editing DNS unnecessarily when nameservers are already with StackCP, where the TXT record is added automatically.
• Assuming DKIM alone solves all deliverability issues. It's one part of a three-part system alongside SPF and DMARC — see our companion DMARC guide for the next step.
• Overthinking the Selector and Granularity fields. Unless you have a specific reason to scope things narrowly, the defaults (a simple selector name, wildcard granularity) work well for the vast majority of businesses.

Troubleshooting

"I generated a signature but I'm not sure it's working." Check that the TXT record appears correctly under Manage DNS if your nameservers are with StackCP. If managed elsewhere, confirm you've manually added the generated record to your external DNS provider.

"My mail is still landing in spam after setting up DKIM." DKIM alone isn't a complete solution — check whether SPF and DMARC (see our companion guide) are also configured, and consider that message content and sending patterns can independently affect spam scoring regardless of authentication setup.

"I manage multiple domains and I'm not sure if I need separate DKIM setups for each." Yes — DKIM is configured per domain, so each domain sending mail needs its own DomainKeys signature set up individually.

A Simple Way to Verify DKIM Is Actually Working

Once configured, it's worth confirming DKIM is genuinely signing your outgoing mail rather than assuming the setup worked correctly:

1. Send a test email from your StackCP mailbox to an external address you also control (a personal Gmail account works well for this test).
2. Open the received message and view its full headers/original message source (most email providers offer a "show original" or "view source" option).
3. Look for a DKIM-Signature header and, ideally, a note indicating the signature passed verification (dkim=pass).

This quick check takes a couple of minutes and gives you real confidence the configuration is active, rather than assuming it's working simply because you completed the setup steps.

Why Selector Naming Matters More Than It First Appears

While the Selector field might seem like a minor, arbitrary label, it has a genuinely useful purpose beyond just identifying the record: if you ever need to rotate your DKIM key (a recommended security practice over time, similar to periodically changing a password), using a new, distinct selector for the new key lets you publish and test it in parallel with the old one before fully retiring the previous key. For most small businesses just getting started, though, a simple, memorable selector like default or mail is entirely sufficient, and key rotation is a refinement worth considering later rather than a day-one concern.