Setting up DKIM at IONOS — Step-by-Step Guide (2026)

Last updated: July 2026

In short: After this guide IONOS signs your outgoing email with DKIM, and receiving servers can verify the signature via your DNS zone.

Prerequisites

An IONOS contract with email mailboxes for your domain
Access to your IONOS account (login.ionos.de)

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server fetches the matching public key from your DNS and uses it to check whether the message really comes from your domain and wasn’t altered in transit. IONOS puts it succinctly in its own docs: the public key is published as a TXT record in the domain’s DNS zone.

For context: while SPF authorizes the server, DKIM secures the message itself. Only together with DMARC does it become a solid foundation — DKIM is the second of three building blocks.

The starting point at IONOS

As with SPF, IONOS takes the work off your hands: DKIM is active by default, as long as you use the IONOS nameservers (the default setting). IONOS sets up the necessary DNS records automatically — you don’t need to do anything.

The clever part is in the mechanism: IONOS publishes the key not as a rigid TXT record in your zone, but via CNAME entries pointing to IONOS target hosts. The actual key lives at IONOS (e.g. at s1.dkim.ionos.com) — this way IONOS can rotate the keys without you ever having to touch anything again.

You only need to act in two cases: if the DKIM entries were accidentally deleted, or if your DNS zone is with another provider.

Step-by-step guide

1. Check whether DKIM is active

DKIM can’t be checked as conveniently with a single dig as SPF, because you need to know the selector. The easiest way is to drop your domain into the free MXAudit scanner — it recognizes the IONOS selectors and shows you whether signing works. Alternatively in the terminal, if you know the selector:

dig CNAME s1-ionos._domainkey.example.com +short

If s1.dkim.ionos.com comes back, the first DKIM CNAME is set.

2. With IONOS nameservers: do nothing

If you use the default IONOS nameservers, DKIM is already set up. You’re done here — jump to Verify the result.

3. (Re-)activate DKIM — the 3 CNAME entries

If the entries were deleted or your DNS zone is external, you create three CNAME entries. Open your domain’s DNS settings and choose Add record → CNAME. The two fixed IONOS selectors:

Hostname	Points to	TTL
`s1-ionos._domainkey`	`s1.dkim.ionos.com`	1 hour
`s2-ionos._domainkey`	`s2.dkim.ionos.com`	1 hour

The TTL is preset to 1 hour at IONOS — nothing to change here.

Important: IONOS shows a third, account-specific selector in the guide (in the form sNNNNNNNN._domainkey → sNNNNNNNN.dkim.ionos.com, with your account number). Take this third entry exactly from your own IONOS account — it differs from customer to customer. Don’t copy the example number from some guide.

4. DKIM for subdomains

If a subdomain also sends (e.g. blog.example.com), you need the same three CNAME entries with the subdomain name appended — IONOS uses the placeholder SUBDOMAIN_NAME for this:

s1-ionos._domainkey.blog    CNAME    s1.dkim.ionos.com
s2-ionos._domainkey.blog    CNAME    s2.dkim.ionos.com

(plus the account-specific third entry, also with .blog).

5. Wait until the change is live

CNAME changes, like all DNS records, take some time; due to caching it can take a few hours until every server sees the new entry.

Verify the result

Check your configuration with the free MXAudit scanner — it shows you whether DKIM signs correctly and the selectors resolve in DNS, together with SPF and DMARC at a glance.

Common mistakes

Created a TXT entry instead of a CNAME. For external DNS, IONOS works with CNAME entries pointing to *.dkim.ionos.com — not with a self-entered TXT key. Entering an old key as TXT blocks the automatic rotation.

Copied the third selector from someone else’s guide. The third entry is account-specific. The example number from a forum post doesn’t match your account — take the values from your own IONOS panel.

Created only one of three CNAMEs. DKIM signing works reliably only once all the intended selectors resolve. Create all three.

Forgot the subdomain. If a subdomain sends, it needs its own DKIM CNAMEs with the subdomain name appended — the main domain’s records don’t apply automatically.