DKIM is a cryptographic signature on every email you send. Inbox providers use it to verify two things: the email really came from your domain, and nothing was changed in transit. Without it, your emails are more likely to land in spam.
What is DKIM?
When PristineSend sends an email on your behalf, it attaches an invisible signature generated using a private key. Your DNS records contain the matching public key. When the recipient's mail server receives the email, it fetches your public key from DNS and uses it to verify the signature. If the signature checks out, the email passes DKIM — which is a strong positive signal for inbox placement.
You'll add three CNAME records to your DNS. Each one points to a key managed by PristineSend, so key rotation happens automatically — you won't need to update your DNS again.
Find your DKIM records
Sign in to PristineSend and open Settings → Sending domain.
Enter your domain name and click Generate records.
You'll see three CNAME records. They look like this (your actual values will differ):
Keep this tab open — you'll copy each value into your registrar in the next step.
Add the records at your registrar
Your registrar is wherever you bought or manage your domain. Find yours below. The steps are slightly different per provider, but the DNS record values are the same everywhere.
You'll be adding 3 CNAME records. Here's what a single record looks like — use your actual values from PristineSend:
Type
CNAME
Name
em1234._domainkey.yourdomain.com
Value
em1234.dkim.pristinesend.com
TTL
Auto (or 3600)
Some registrars only want the part before your domain in the Name field. If your domain is yourdomain.com and the full name is em1234._domainkey.yourdomain.com, enter only em1234._domainkey.
GoDaddy
Log in to GoDaddy and open My Products.
Next to your domain, click DNS.
Click Add New Record.
Set Type to CNAME.
Paste the Name value from PristineSend (just the subdomain part, without your root domain).
Paste the Value into the Data field.
Set TTL to 1 hour (or leave it on Auto).
Click Save. Repeat for all 3 records.
Namecheap
Log in to Namecheap and go to Domain List.
Click Manage next to your domain, then open the Advanced DNS tab.
Click Add New Record and select CNAME Record.
Enter the subdomain part only in the Host field (e.g. em1234._domainkey).
Paste the Value into the Target field.
Set TTL to Automatic and click the green checkmark to save. Repeat for all 3 records.
Cloudflare
Log in to the Cloudflare dashboard and select your domain.
Open DNS → Records and click Add record.
Set Type to CNAME.
Paste the Name value (subdomain only) into the Name field.
Paste the Value into the Target field.
⚠ Important: Make sure the Proxy status is set to DNS only (grey cloud, not orange). Proxied DKIM records will fail verification.
Click Save. Repeat for all 3 records.
Google Domains / Squarespace Domains
Open Google Domains (now Squarespace Domains) and select your domain.
Go to DNS → Custom records.
Click Manage custom records → Create new record.
Set Type to CNAME.
Enter the subdomain in the Host name field.
Paste the Value into the Data field, then click Save. Repeat for all 3 records.
Verify the setup worked
After adding the records, go back to Settings → Sending domain in PristineSend and click Verify records. PristineSend will check all three CNAMEs.
If DNS hasn't propagated yet, the check will show a pending status. Wait 15–30 minutes and try again. Full propagation can take up to 48 hours, though it's usually much faster.
You can also check propagation yourself using dnschecker.org — paste in your CNAME host name and confirm it resolves to the PristineSend value from multiple locations.
Common errors
Record shows "not found"
DNS hasn't propagated yet. Wait 30 minutes and check again with dnschecker.org.
DKIM fails even after propagation
Check for typos in the Name or Value. Watch out for an extra dot at the end of the value — some registrars add one automatically, which breaks the CNAME.
Cloudflare DKIM keeps failing
The Cloudflare proxy (orange cloud) intercepts and rewrites CNAME lookups. Switch to "DNS only" (grey cloud) on all three DKIM records.
Registrar says "that record already exists"
You may have an old DKIM record from another provider. Delete the old one first, then add the new one.