Is it possible to alias DKIM records, and what is NS delegation?

Summary

DKIM records can be aliased using CNAME records, often pointing to an ESP's servers, allowing the ESP to handle DKIM key rotation. Cloudflare and other DNS services may flatten CNAMEs to A records for proper DKIM function. NS delegation involves handing off a subdomain to another party, enabling distributed management of DNS zones and promoting service portability. Although aliasing DKIM is possible, the final destination may still be visible in DNS lookups. Implementing NS delegation can be challenging due to client DNS knowledge and action requirements. Proper planning for distributed responsibilities when utilizing NS Delegation is essential.

Key findings

  • DKIM Aliasing via CNAME: DKIM records can be aliased using CNAME records, simplifying management through ESPs.
  • NS Delegation Explained: NS delegation provides control of a subdomain's DNS records to a third party.
  • CNAME Flattening: CNAME flattening resolves CNAMEs to A records, ensuring proper DKIM functionality.
  • Benefits of NS Delegation: NS delegation enables service portability, separation of responsibilities, and distributed DNS management.
  • Service Portability: Service Portability is achieved because you can switch service provider at any time by changing the DNS at your DNS provider without affecting the client.

Key considerations

  • Hidden Destination: Aliasing DKIM records might not completely hide the underlying service provider in DNS lookups.
  • Client Involvement: Getting clients to implement NS delegation can be challenging; ensure they understand the process.
  • Proper DKIM: If you are using CNAME for DKIM make sure that the ESP manages the key rotation effectively.
  • Distributing Managment: When delegating responsibilities across teams, create proper processes and documentation so each team can correctly manage their subdomains.
  • Matching Subdomains: When configuring a CNAME record, the subdomain must 100% match your provider's settings in order to properly configure DKIM or SPF

What email marketers say
9Marketer opinions

DKIM records can be aliased using CNAME records, allowing ESPs to manage DKIM key rotation. NS delegation enables handing off control of a subdomain to a third party, facilitating service portability and separation of concerns. It allows a third party to manage all DNS records for that subdomain. CNAME records point a domain name to another domain name, updating automatically when the target IP address changes. CNAME flattening resolves CNAME records to A records, essential for certain DNS configurations. NS delegation separates DNS management responsibilities among different teams or organizations.

Key opinions

  • DKIM Aliasing: DKIM records can be aliased using CNAME records, enabling ESPs to manage DKIM configurations.
  • NS Delegation Purpose: NS delegation allows handing off control of a subdomain to a third party for independent DNS management.
  • CNAME Use Case: CNAME records point a domain to another domain, ensuring automatic IP address updates.
  • CNAME Flattening: CNAME flattening resolves CNAME records to A records for correct DNS configurations.
  • NS Delegation Benefit: NS delegation facilitates service portability and separation of DNS management responsibilities.

Key considerations

  • CNAME vs A Records: Use CNAME records when pointing to a domain name rather than a static IP address, allowing for automatic updates.
  • Service Portability: NS delegation can be employed to switch between different providers without DNS changes for users.
  • Delegation Management: NS delegation needs careful management to ensure the third party manages all the DNS records properly for that subdomain.
  • DKIM Configuration: When using CNAME for DKIM aliasing ensure the ESP can manage DKIM key rotation effectively.
  • Domain Apex: Consider CNAME flattening if a domain apex needs to point to a service providing only an IP address.
Marketer view

Email marketer from Web Hosting Talk mentions that NS delegation can be used for service portability. By delegating a subdomain to your own name servers, you can switch between different providers without requiring your users to change their DNS settings. This gives you more flexibility and control over your infrastructure.

March 2024 - Web Hosting Talk
Marketer view

Email marketer from StackExchange explains that CNAME flattening is a technique used by DNS providers to automatically resolve CNAME records to their underlying A records. This is important for certain DNS configurations, such as when a domain apex (e.g., example.com) needs to point to a service that only provides an IP address.

February 2023 - StackExchange
Marketer view

Email marketer from Quora explains that NS delegation helps in separating concerns and responsibilities for different parts of a domain. This allows different teams or organizations to manage their respective parts of the DNS without interfering with each other, improving overall efficiency and security.

August 2024 - Quora
Marketer view

Email marketer from Superuser answers that DKIM records can be aliased using CNAME records. Instead of directly setting the DKIM TXT record on your domain, you can create a CNAME record that points to the ESP's DKIM record. This allows the ESP to manage the DKIM key rotation and other DKIM configurations.

January 2024 - Superuser
Marketer view

Marketer from Email Geeks explains that aliasing DKIM records is possible, as many ESPs built on top of cloud ESPs do this. You need to generate a sending domain per client with the selector, but point them to your DNS in your UI. SendGrid checks for the TXT and downstream records, not the CNAME. Matching the subdomains exactly is important. Also suggests NS delegation.

November 2023 - Email Geeks
Marketer view

Email marketer from Medium states that CNAME records are used when you want a domain name to point to another domain name, rather than an IP address. This is useful when the IP address of the target domain might change, as the CNAME record will automatically update to the new IP address. A records directly map a domain name to an IP address.

November 2022 - Medium
Marketer view

Email marketer from Reddit shares that NS delegation is commonly used for handing off control of a subdomain to a third-party service, such as a hosting provider or a CDN. By delegating the subdomain, the third party can manage all DNS records for that subdomain, making integration and management easier.

May 2022 - Reddit
Marketer view

Email marketer from Stack Overflow explains that NS delegation allows you to delegate a subdomain to a third-party DNS provider. This is useful when you want to give control of a portion of your domain to another entity, allowing them to manage DNS records independently.

November 2022 - Stack Overflow
Marketer view

Email marketer from DNSimple explains that an NS record delegates a domain or subdomain to a set of name servers. This delegation means the specified name servers are authoritative for that domain or subdomain, and all DNS queries will be directed to those servers.

October 2023 - DNSimple Support

What the experts say
3Expert opinions

NS delegation involves handing off a subdomain to another party, allowing them to manage DNS records. This can separate responsibilities, but getting clients to implement NS delegation can be challenging. When aliasing DKIM records via CNAME, the ultimate destination (e.g., SendGrid) can still be visible upon record lookup.

Key opinions

  • NS Delegation Definition: NS delegation gives control of a subdomain's DNS records to another entity.
  • NS Delegation Purpose: NS delegation can be used to separate concerns and allow different systems to manage the zone.
  • DKIM Aliasing Visibility: Aliasing DKIM records might not fully hide the underlying service provider (e.g., SendGrid).

Key considerations

  • Client Implementation: Implementing NS delegation can be difficult due to client involvement and DNS knowledge.
  • Record Visibility: When using CNAME records, be aware that a complete DNS lookup can reveal the final destination.
  • Management of Delegated Subdomain: When delegating NS records you are handing off control of all DNS record management on the delegated subdomains.
Expert view

Expert from Email Geeks warns that getting clients to actually do NS delegation can be a pain, despite it being a better approach.

February 2022 - Email Geeks
Expert view

Expert from Email Geeks explains that if you look up the record, it will end up at SendGrid, so it is hidden but not completely. Regarding NS Delegation NS just means your team needs to manage all the DNS records for your clients. The client sets up the NS record pointing to your DNS servers, and you manage all the DNS beyond that.

March 2025 - Email Geeks
Expert view

Expert from Word to the Wise explains that subdomain delegation (NS delegation) is handing off a subdomain to someone else, letting them control the DNS records on the delegated subdomain. It can be used to separate concerns and to allow other systems or people to manage the zone.

April 2024 - Word to the Wise

What the documentation says
6Technical articles

DKIM records can be aliased using CNAME records, pointing to ESP's servers. Cloudflare flattens these CNAMEs to A records for correct DKIM function. NS records delegate authority for a domain/subdomain to specific name servers, enabling distributed DNS management. DKIM relies on DNS to store public keys for signature verification. AWS Route 53 also supports subdomain delegation to other DNS services using NS records.

Key findings

  • DKIM with CNAME: DKIM records are often implemented with CNAME records pointing to ESP servers.
  • CNAME Flattening: Cloudflare automatically flattens DKIM CNAME records to A records for functionality.
  • NS Delegation: NS records delegate authority of domain/subdomain to name servers, enabling distributed management.
  • DKIM and DNS: DKIM relies on DNS to store public keys for signature verification.
  • Subdomain Delegation on AWS: AWS Route 53 supports subdomain delegation using NS records to different DNS providers.

Key considerations

  • CNAME Compatibility: Ensure your domain provider supports CNAME records when implementing DKIM.
  • DNS Zone Management: NS delegation allows for distributed management which allows you to manage DNS zones accross multiple entities.
  • Distributed Management: NS Delegation will require consideration of how each entity will handle DNS requirements such as TTLs, A records and more.
Technical article

Documentation from DigitalOcean shares that NS records are used to delegate a zone (domain or subdomain) to a set of name servers. When a DNS resolver queries a domain, it uses the NS records to determine which name servers are authoritative for that domain, and thus, where to find the relevant DNS records.

August 2022 - DigitalOcean
Technical article

Documentation from RFC Editor explains that Name Server (NS) records are used to delegate authority for a domain or subdomain to a specific set of name servers. This delegation allows for distributed management of DNS zones, where different parts of the domain can be managed by different entities.

July 2023 - RFC Editor
Technical article

Documentation from Google explains that to add a DKIM record, you may need to add a CNAME record provided by Google, and the CNAME record will point to Google servers to verify DKIM. It is important to check with your domain provider to ensure CNAME is allowed.

February 2023 - Google
Technical article

Documentation from IETF details that DKIM relies on DNS to store the public key used to verify email signatures. The DKIM record is stored as a TXT record in the DNS zone for the domain, and the receiving mail server retrieves this record to validate the DKIM signature on incoming emails.

July 2022 - IETF
Technical article

Documentation from Cloudflare explains that DKIM records often use CNAME records to point to the ESP's servers. Cloudflare automatically flattens these CNAMEs, resolving them to the underlying A records, which is necessary for DKIM to function correctly. This ensures that the correct DKIM signature is used for email authentication.

May 2023 - Cloudflare
Technical article

Documentation from Amazon Web Services explains that Route 53 allows you to delegate subdomains to other DNS services. You create NS records in the parent domain's zone that point to the name servers for the delegated subdomain. This enables you to use different DNS providers for different parts of your domain.

March 2022 - AWS

No related resources found.