Last updated: July 2026
In short: After this guide your domain publishes two DKIM CNAME entries in the CCP, so Netcup can sign your mail and receiving servers can verify it.
This guide applies to Netcup web hosting. On vServers and root servers you sign with your own mail server software (e.g. Mailcow, OpenDKIM) and publish its keys yourself.
Prerequisites
- A Netcup web hosting package with at least one domain
- Access to the Customer Control Panel (CCP)
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing email — it ensures the mail wasn’t altered and comes from the rightful sender. The receiving server fetches the public key from DNS and uses it to check the signature.
For context: while SPF authorizes the server, DKIM secures the message. Only together with DMARC does it make a solid foundation.
The starting point at Netcup
As with the SPF include, Netcup also works with CNAME delegation for DKIM: you create two CNAME entries pointing to Netcup target hosts. The actual keys live at Netcup under webhosting.systems — this way Netcup can rotate them without you ever having to touch anything again.
Important and easily overlooked: both entries (key1 and key2) are mandatory. Netcup states this explicitly. If you only create one, you don’t get complete DKIM protection.
And the same caveat as with SPF applies: the records only work if standard DNS is used and mail is sent exclusively via the Netcup mail servers — sending via the web server (phpmail/sendmail) or external servers is not covered.
Step-by-step guide
1. Check whether DKIM is active
The easiest way is to drop your domain into the free MXAudit scanner — it recognizes the Netcup selectors. In the terminal:
dig CNAME key1._domainkey.example.com +shortIf key1._domainkey.webhosting.systems comes back, the first DKIM CNAME is set.
2. Open the DNS settings in the CCP
Log into the CCP, open Domains, click the magnifying glass icon next to your domain, and switch to the DNS tab.
3. Create both DKIM CNAME entries
Create these two entries one after another:
| Host | Type | Destination |
|---|---|---|
key1._domainkey | CNAME | key1._domainkey.webhosting.systems |
key2._domainkey | CNAME | key2._domainkey.webhosting.systems |
Both are required — really create both, not just the first.
4. Wait until the change is live
DNS changes take time: depending on TTL and caching it can take a few hours until every server sees the new entries.
Verify the result
Check your configuration with the free MXAudit scanner — it shows you DKIM, SPF, and DMARC at a glance.
Common mistakes
Only created key1. Netcup explicitly requires both entries (key1 and key2). If one is missing, the DKIM protection is incomplete.
TXT instead of CNAME. Netcup works with CNAME delegation to webhosting.systems — don’t enter a static TXT key, or you lose the automatic key rotation.
Web server sending. Just as with SPF: mail that goes out directly from the web server via phpmail/sendmail is not signed. Use SMTP via the Netcup mail servers.
Changed the selector name. The host stays exactly key1._domainkey or key2._domainkey — don’t rename it.
Further reading
- Netcup Helpcenter: DNS Records (web hosting) (retrieved: July 10, 2026)
- RFC 6376 — DomainKeys Identified Mail (DKIM)