How to implement DKIM without a TXT record?

Summary

Implementing DKIM without a TXT record involves utilizing CNAME records in DNS. This method allows the DKIM selector to point to another domain, typically managed by a third-party email service provider (ESP), where the actual DKIM TXT record is hosted. This approach simplifies DKIM management, enabling easy key rotation and delegation of signing to the ESP, without requiring full access to the root domain. It's best practice to ensure all subdomains also have DKIM records and the CNAME target is correctly configured and maintained.

Key findings

  • CNAME Implementation: DKIM can be implemented without a TXT record by utilizing CNAME records in the DNS settings.
  • Delegated Management: CNAMEs allow delegation of DKIM key management and signing to a third-party email service provider (ESP).
  • Simplified Key Rotation: Using CNAMEs simplifies DKIM key rotation, which is often automated by the ESP.
  • Enhanced Security: Delegating via CNAME can enhance security by allowing third-party services to manage keys without full access to the root domain.

Key considerations

  • Correct Configuration: Ensure the CNAME record is correctly configured and points to the appropriate domain managed by the ESP.
  • Maintenance: Verify the delegated service (ESP) properly maintains, and rotates the DKIM keys.
  • Subdomain DKIM: Ensure all subdomains have properly configured DKIM records.

What email marketers say
8Marketer opinions

Implementing DKIM without a TXT record typically involves using a CNAME record in your DNS settings. This CNAME record points to another domain, often managed by a third-party email service provider (ESP) like SendGrid or Mailgun, where the actual DKIM TXT record is hosted. This approach allows for easier DKIM key rotation and management by the ESP, simplifying the process for the domain owner, especially in larger organizations. However, it's crucial to ensure that the CNAME target is correctly configured and maintained by the delegated service.

Key opinions

  • CNAME Usage: DKIM can be implemented without a TXT record by utilizing CNAME records in DNS settings.
  • Delegation of Management: Using a CNAME allows delegating DKIM key management to a third-party email service provider (ESP).
  • Simplified Key Rotation: CNAME implementation simplifies DKIM key rotation as the ESP manages the TXT record.
  • Best Practice: DKIM using CNAME is considered to be best practice for DKIM management

Key considerations

  • Correct Configuration: Ensure the CNAME record is correctly configured and points to the appropriate domain managed by the ESP.
  • Maintenance: Verify that the delegated service (ESP) properly maintains and rotates the DKIM keys.
Marketer view

Email marketer from Reddit shares that using a CNAME record for DKIM is a common practice when you want to delegate the management of your DKIM key to a third-party service. This allows the service to rotate the key without you needing to update your DNS records directly.

April 2021 - Reddit
Marketer view

Email marketer from MXToolbox describes setting up DKIM with a CNAME record pointing to a service like SendGrid or Mailgun, which handles the TXT record. They also mention that this simplifies DKIM management, especially for larger organizations

May 2021 - MXToolbox
Marketer view

Email marketer from StackExchange explains that you can create a CNAME record in your DNS that points to another domain. Then you can put the DKIM TXT record on that other domain. This allows you to update the DKIM key on the other domain without having to change the DNS records on your primary domain.

June 2022 - StackExchange
Marketer view

Email marketer from AuthSMTP explains how DKIM CNAME is the best option as you are not managing the DKIM keys directly. This is required when you use AuthSMTP.

December 2022 - AuthSMTP
Marketer view

Marketer from Email Geeks answers you can do DKIM without a TXT record via CNAME.

February 2024 - Email Geeks
Marketer view

Email marketer from Mailgun's documentation shares that DKIM is implemented by creating CNAME records in DNS. Mailgun then hosts the TXT record for DKIM. They also say the CNAME method is best practice as it simplifies DKIM management.

December 2022 - Mailgun
Marketer view

Email marketer from StackOverflow explains using CNAMEs for DKIM records allows an external service to manage the DKIM key. This is done by creating a CNAME record pointing to the service's domain which hosts the actual DKIM TXT record, allowing easier key rotation and management by the service provider.

April 2021 - StackOverflow
Marketer view

Email marketer from SuperUser shares their experience using CNAME records for DKIM delegation, finding it simplified their DKIM management process. They emphasize the importance of ensuring the CNAME target is correctly configured and maintained by the delegated service.

January 2024 - SuperUser

What the experts say
4Expert opinions

Implementing DKIM without a TXT record is achieved by utilizing a CNAME record. This CNAME points to a domain, frequently managed by a third-party email service provider (ESP), where the actual DKIM TXT record resides. This method allows for delegation of signing to another host, enabling services to manage DKIM keys without requiring full access to the root domain. It's important to ensure all subdomains also have DKIM records.

Key opinions

  • CNAME Implementation: DKIM without a TXT record is implemented using a CNAME record.
  • Delegation of Signing: CNAMEs allow delegation of DKIM signing to a different host, often a third-party ESP.
  • Security Benefits: Using a CNAME with third-party services allows them to manage keys without full access to the root domain.

Key considerations

  • Subdomain DKIM: Ensure all subdomains have DKIM records configured.
Expert view

Marketer from Email Geeks answers you can do DKIM without a TXT record using CNAME.

August 2024 - Email Geeks
Expert view

Expert from Spam Resource explains that to implement DKIM using a CNAME record, you create a CNAME record that points to the domain where the actual DKIM TXT record is hosted. This is often used when delegating DKIM management to a third-party email service provider.

October 2021 - Spam Resource
Expert view

Expert from Email Geeks answers you can do DKIM without a TXT record using CNAME.

July 2024 - Email Geeks
Expert view

Expert from Word to the Wise explains using CNAMEs in DKIM allows delegation of signing to a different host. They also mention it can be used with services where you don't want them to have full access to your root domain. However, they advise ensuring all your subdomains also have DKIM records.

December 2022 - Word to the Wise

What the documentation says
4Technical articles

Implementing DKIM without a TXT record is achievable using CNAME records in DNS. This method allows the DKIM selector record to point to another domain, often managed by a third-party service like SendGrid, where the DKIM TXT record is stored. This simplifies key rotation and delegates DKIM management to the third-party service.

Key findings

  • CNAME Support: DKIM supports the use of CNAME records for DKIM keys.
  • Delegated Management: CNAME records facilitate delegating DKIM management to third-party services.
  • Simplified Rotation: Using CNAMEs simplifies DKIM key rotation, often automated by the third-party service.

Key considerations

Technical article

Documentation from SendGrid explains that to implement DKIM with SendGrid, users create CNAME records in their DNS settings that point to SendGrid's servers. SendGrid then manages the actual DKIM key and rotates it automatically, simplifying the process for the user.

October 2022 - SendGrid
Technical article

Documentation from RFC Editor explains that DKIM (DomainKeys Identified Mail) allows for DNS CNAME records to be used for DKIM keys. The selector record can point to another domain where the TXT record is stored, using a CNAME.

October 2023 - RFC Editor
Technical article

Documentation from Google Workspace Admin Help states that using CNAME records for DKIM is a supported method for delegating DKIM management to services like SendGrid. It outlines the steps for creating a CNAME record that points to the service's DKIM record.

October 2023 - Google
Technical article

Documentation from Cloudflare clarifies that CNAME records are valid for DKIM, especially when using a third-party email service. The CNAME points to the third-party's domain, where they manage the DKIM TXT record. This simplifies DKIM key rotation.

November 2022 - Cloudflare