Complete DKIM Setup Guide for Cold Email (2026)

DKIM (DomainKeys Identified Mail) is a non-negotiable for cold email in 2026. Without it, Gmail, Outlook, and every major inbox provider will either reject your emails outright or send them straight to spam. This guide walks you through exactly how to set it up — from DNS records to verification — for Postmark, SendGrid, and custom SMTP setups.

We spent 13 days debugging DKIM issues while building OutboundHQ. This guide distills everything we learned so you don't have to.

What Is DKIM?

DKIM is an email authentication protocol that lets receiving mail servers verify that an email was actually sent by the domain it claims to be from, and that the message wasn't tampered with in transit.

Here's how it works at a high level:

1. Your sending server generates a private key and uses it to sign outgoing emails with a cryptographic signature added to the email headers.
2. You publish the corresponding public key in your domain's DNS as a TXT record.
3. When Gmail (or any receiving server) gets your email, it looks up your public key from DNS and uses it to verify the signature — confirming the email is legitimate and unmodified.

If the signature doesn't match — because the email was forged, or someone tampered with it — the check fails and the email gets flagged or rejected.

Why DKIM Matters for Cold Email

For transactional email, DKIM is helpful. For cold email, it's existential. Here's why:

• Inbox placement. Gmail's spam filter heavily weights authentication signals. Missing DKIM = automatic trust deficit. With DKIM properly configured, your emails are far more likely to land in the primary tab.
• Domain reputation. ESPs (email service providers) track sender reputation by domain. DKIM links your emails to your domain, which means your good sending behavior builds reputation over time. Without it, that goodwill evaporates.
• DMARC enforcement. DMARC — the policy layer on top of SPF and DKIM — requires at least one to pass. If you're sending without DKIM and your DMARC policy is set to reject or quarantine, your emails get dropped.
• Open rate accuracy. This one surprises people: some security scanners (the bots that inflate your open metrics) only scan emails that passed authentication. Without DKIM, your open data is both wrong in a different direction and your reputation suffers.

DKIM Setup for Postmark

Postmark is one of the better-documented ESPs for DKIM setup, and it's what we use at OutboundHQ. Here's the exact process:

Step 1: Add your sending domain to Postmark

1. Log in to your Postmark account.
2. Navigate to Sender Signatures → Add Domain or Signature.
3. Choose Domain (not signature) — this lets you send from any address at that domain.
4. Enter your domain (e.g., yourdomain.com) and click Continue.

Step 2: Copy the DKIM DNS record

Postmark will show you a TXT record to add to your DNS. It looks like this:

Type:  TXT
Host:  pm._domainkey.yourdomain.com
Value: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

The pm prefix is the DKIM selector — it's how receiving servers know which key to look up. Postmark uses pm, but each ESP has its own convention.

Step 3: Add the TXT record to your DNS

Go to your DNS provider (Cloudflare, Route 53, Namecheap, GoDaddy, wherever your domain lives) and add the TXT record exactly as Postmark provided. A few things to watch for:

• Host field: Some DNS providers want just pm._domainkey (without the root domain), others want the full pm._domainkey.yourdomain.com. If in doubt, try the shorter version first.
• No quotes: Some DNS UIs auto-add quotes around TXT values; others require you to add them manually. Postmark's value should not have surrounding quotes when you copy it — if your DNS panel adds them, that's usually fine.
• TTL: Set it to 300 (5 minutes) while you're verifying, then bump to 3600 or auto after confirmation.

Step 4: Verify in Postmark

Back in Postmark, click Verify DKIM. DNS propagation can take anywhere from 5 minutes to 48 hours, but usually resolves within 30 minutes. If it fails immediately after adding the record, wait 10 minutes and try again.

DKIM Setup for SendGrid

SendGrid calls their DKIM process "Domain Authentication" and it adds both DKIM and SPF in one flow. Here's how:

Step 1: Authenticate your domain

1. In SendGrid, go to Settings → Sender Authentication.
2. Click Authenticate Your Domain.
3. Select your DNS provider from the dropdown (or choose "Other" if yours isn't listed).
4. Enter your domain and click Next.

Step 2: Add the CNAME records

SendGrid uses CNAME records instead of TXT records for DKIM. You'll get three records to add:

Type:  CNAME
Host:  s1._domainkey.yourdomain.com
Value: s1.domainkey.u123456.wl.sendgrid.net

Type:  CNAME
Host:  s2._domainkey.yourdomain.com
Value: s2.domainkey.u123456.wl.sendgrid.net

Type:  CNAME
Host:  em1234.yourdomain.com
Value: u123456.wl.sendgrid.net

Add all three to your DNS exactly as shown. The third CNAME (em####) handles SPF via subdomain alignment.

Step 3: Verify

Back in SendGrid, click Verify. If it fails, wait and retry — CNAME propagation can lag. You can also check propagation manually:

dig CNAME s1._domainkey.yourdomain.com

If you see the expected sendgrid.net value returned, DNS has propagated and SendGrid should verify on the next check.

DKIM Setup for Custom SMTP

If you're running your own mail server (Postfix, Exim, or using something like mailcow), you'll need to generate your own DKIM keys and set up OpenDKIM.

Generate a DKIM key pair

openssl genrsa -out dkim_private.pem 2048
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

Choose a selector name — convention is the year and month (e.g., 2026-05) so you can rotate keys on a schedule.

Add the TXT record

Format your public key for DNS. Strip the header/footer lines and concatenate into one string:

Type:  TXT
Host:  2026-05._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY_HERE

The v=DKIM1 tag is required. The k=rsa specifies the key type. The p= value is your base64-encoded public key (without PEM headers).

Configure OpenDKIM

In your OpenDKIM config (/etc/opendkim.conf):

Domain                  yourdomain.com
KeyFile                 /etc/opendkim/keys/dkim_private.pem
Selector                2026-05
Socket                  inet:12301@localhost

Then wire OpenDKIM into Postfix's milter configuration. The exact steps depend on your server setup — see the OpenDKIM documentation for your distribution.

Testing and Verifying DKIM

Don't assume DKIM is working just because the DNS record is live. Always test:

Method 1: mail-tester.com

Send an email from your domain to the unique address that mail-tester.com generates. It gives you a full authentication report including DKIM pass/fail, SPF status, and DMARC alignment — and shows you the actual headers so you can see what's being signed.

Method 2: Google's Admin Toolbox

Google provides a free MX lookup tool that checks DNS records including DKIM. Enter your domain and selector to confirm the record is properly formatted and reachable.

Method 3: Check email headers directly

Send yourself a test email and inspect the raw headers. In Gmail: click the three-dot menu → Show original. Look for:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=yourdomain.com; s=pm; ...

And further down in the authentication results:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@yourdomain.com header.s=pm header.b=XXXXXXXX

dkim=pass is what you're looking for. Anything else means something is misconfigured.

Common DKIM Mistakes

1. Wrong DNS host format

The most common mistake. Your DNS provider might want pm._domainkey or pm._domainkey.yourdomain.com — they vary. If verification fails, try the other format. Also double-check you're not accidentally adding .yourdomain.com.yourdomain.com (some panels auto-append the root domain).

2. Whitespace in the public key value

When pasting long DKIM values, line breaks can sneak in. The DNS value should be a single unbroken string. If your DNS panel shows it split across multiple lines, make sure it's treating that as one value, not multiple records.

3. Multiple DKIM records for the same selector

If you have two TXT records with the same host (pm._domainkey.yourdomain.com), DKIM breaks. Only one record per selector is allowed. Delete any duplicate and re-verify.

4. Using a shared domain for cold email

Even with perfect DKIM, sending cold email from info@gmail.com or a fresh domain with no history is a deliverability red flag. DKIM is one piece of the puzzle — domain age, warmup, and sending volume matter too. See our guide on deliverability tools for the full picture.

5. Not aligning DKIM with DMARC

DMARC requires your "From" domain to align with the domain in your DKIM signature. If you're sending from hello@mail.yourdomain.com but signing with yourdomain.com, check whether your DMARC policy requires strict or relaxed alignment. Relaxed alignment (the default) allows subdomain matches; strict requires exact matches.

DKIM + SPF + DMARC: The Full Picture

DKIM doesn't operate in isolation. Here's the minimum authentication stack for cold email in 2026:

• SPF — Specifies which mail servers are allowed to send on behalf of your domain. Prevents spoofing at the sending IP level.
• DKIM — Signs the email content. Confirms authenticity and integrity in transit.
• DMARC — Policy layer. Tells receiving servers what to do if SPF or DKIM fails: nothing (none), quarantine to spam (quarantine), or reject outright (reject). Also enables reporting so you can see who's sending on your behalf.

A minimal DMARC record looks like:

Type:  TXT
Host:  _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Start with p=none to collect reports without affecting delivery. Once you've confirmed DKIM and SPF are passing consistently, move to p=quarantine, then p=reject.

Verifying Everything Is Working

Once DKIM is set up, run through this checklist before your first campaign:

• ✓ DKIM TXT record returns correctly in DNS lookup (dig TXT pm._domainkey.yourdomain.com)
• ✓ mail-tester.com shows DKIM=pass and score ≥ 9/10
• ✓ Gmail raw headers show dkim=pass in Authentication-Results
• ✓ SPF record is also configured for your sending domain
• ✓ DMARC record is live (even at p=none) to start collecting data
• ✓ Sending domain has some age and warmup history before cold email at volume

---

DKIM is one of those things that takes 30 minutes to set up and saves you weeks of deliverability headaches. Get it done before your first campaign — not after you're already in spam folders trying to figure out why.

For the rest of the deliverability stack, see our guide to the best cold email tools in 2026 and how OutboundHQ compares to Instantly on deliverability features.