DKIM fix

DKIM for Subdomain Email — Setup Guide

Sending from a subdomain? Put DKIM at [selector]._domainkey.[subdomain].yourdomain.com. The parent zone’s key doesn’t magically cover kids.

DNS example

selector._domainkey.mail.example.com → TXT → v=DKIM1; k=rsa; p=...

The lookup is always relative to the signing domain in d=. See DKIM and selectors.

DMARC and subdomains

Policy for subdomains can be set with sp= on the organizational domain's DMARC record, or with a separate DMARC record on the subdomain — plan alignment with your From: domain.

Steps

Step 1 Identify the subdomain that sends mail and the From / signing domain

Step 2 Obtain selector and record values from your ESP or MTA

Step 3 Publish at selector._domainkey.<subdomain>.yourdomain.com

Step 4 Align DMARC: use sp= or subdomain DMARC as needed

Step 5 Verify in DNS Preflight and with a live test send

Check subdomain DKIM DNS

Open DNS Preflight →

Related glossary: DKIM · DMARC alignment

FAQ

Does parent DKIM cover subdomains?

No — keys are queried under each signing domain's _domainkey name.

How do I add subdomain DKIM?

Create the record under the subdomain's DNS zone (or as a FQDN in your host UI).

DMARC sp= for subdomains?

sp= sets subdomain policy when no separate record exists on the child.

Common setups?

Transactional vs marketing subdomains — each may use different providers and selectors.

Verification?

Resolve the exact s._domainkey.d host and send a test message.

← All DKIM fix guides

Open DNS Preflight and re-check your zone →