Last updated: July 2026

In short: After this guide Gandi signs your outgoing email with DKIM, and receiving servers can verify the signature via your DNS zone.

Prerequisites

  • A domain and email mailboxes at Gandi (Gandi Mail)
  • Access to your Gandi account (admin.gandi.net)

What is DKIM?

DKIM (DomainKeys Identified Mail), in Gandi’s words, “allows you to attach a signature to your email showing the email is authorized.” The receiving server fetches the matching public key from your DNS and uses it to check whether the message really comes from your domain and wasn’t altered in transit.

For context: while SPF authorizes the server, DKIM secures the message itself. Only together with DMARC does it become a solid foundation — DKIM is the second of three building blocks.

The starting point at Gandi

Gandi’s mail servers support DKIM signatures. How you turn it on depends on where your DNS lives:

  • Domain and email at Gandi, using Gandi LiveDNS → a single toggle in your account. Gandi publishes the keys for you.
  • Email at Gandi, but DNS at another provider → you add three CNAME records manually, pointing to Gandi’s key hosts.

The clever part is the mechanism: the actual keys live at Gandi (gm1.gandimail.net and friends), and your DNS only points there via CNAME. That way Gandi can rotate the keys without you ever touching anything again.

Step-by-step guide

1. With Gandi LiveDNS: flip the toggle

If your domain and email are hosted by Gandi and the domain uses Gandi LiveDNS, “you can activate DKIM in your account by following these steps”:

  1. Sign in at admin.gandi.net and open your domain.
  2. Click on the Email tab.
  3. Next to Settings & Security click Edit.
  4. Switch the toggle next to DKIM Signature and click Update.

That’s it — Gandi sets up the necessary DNS records. Jump to Verify the result.

2. With external DNS: the 3 CNAME entries

If your domain and email are hosted by Gandi but you do not use Gandi LiveDNS (you point the domain at another nameserver), you can still activate DKIM manually by adding the following three CNAME records at your DNS provider:

gm1._domainkey    CNAME    gm1.gandimail.net.
gm2._domainkey    CNAME    gm2.gandimail.net.
gm3._domainkey    CNAME    gm3.gandimail.net.

All three CNAME records are needed — they exist so Gandi can roll the signing key over without breaking your DKIM.

3. Wait until the change is live

CNAME changes, like all DNS records, take some time; Gandi notes it can take up to 72 hours for changes to take effect everywhere.

Verify the result

Check your configuration with the free MXAudit scanner — it shows you whether DKIM signs correctly and the selectors resolve in DNS, together with SPF and DMARC at a glance. Or in the terminal, if you know the selector:

dig CNAME gm1._domainkey.example.com +short

If gm1.gandimail.net. comes back, the first DKIM CNAME is set.

Common mistakes

Created a TXT entry instead of a CNAME. For external DNS, Gandi works with CNAME entries pointing to *.gandimail.net — not with a self-entered TXT key. Entering an old key as TXT blocks the automatic rotation.

Created only one of three CNAMEs. All three (gm1, gm2, gm3) are required so key rollover keeps working. Create all three.

Toggle and manual CNAMEs. With Gandi LiveDNS the toggle already does everything — you don’t add the CNAMEs by hand as well. The manual route is only for external DNS.

Forgot the trailing dot. The CNAME targets end in a dot (gm1.gandimail.net.) — an absolute name. Some panels add it automatically; check that yours does.

Further reading