Last updated: July 2026

In short: After following this guide your outgoing messages from one.com carry a valid DKIM signature. Receiving mail servers verify the authenticity of your emails via your domain’s DNS and protect against tampering.

Prerequisites

  • A one.com email hosting plan for your domain
  • Access to your one.com Control Panel or your external DNS provider

What is DKIM?

DKIM (DomainKeys Identified Mail) attaches a cryptographic digital signature to every outgoing message. The receiving mail server uses the public key published in your domain’s DNS to confirm that the email originated from your infrastructure and arrived unmodified.

As one.com states in their official documentation: All emails you send already include a DKIM signature, and all emails you receive are checked for the digital DKIM signature.

For context: while SPF authorizes servers to transmit messages, DKIM guarantees the integrity of the message itself. Together with DMARC, DKIM forms the backbone of modern email security.

The starting point at one.com

If your domain and nameservers are hosted directly with one.com, DKIM is handled fully automatically without manual intervention: If you use one.com for email hosting, DKIM is enabled automatically when your domain uses our name servers.

As a result, you do not need to create manual TXT or CNAME records in your Control Panel as long as your domain relies on one.com’s default nameservers. You only need to take action if your email is hosted by one.com while your nameservers are managed by an external DNS provider.

Step-by-step guide

1. When using one.com nameservers: No action required

If your domain points to one.com’s default nameservers, DKIM signing is already active. one.com manages key generation, rotation, and DNS publication automatically in the background. You can skip ahead directly to Verify the result.

2. External DNS: Request CNAME values from support

If your domain’s DNS zone is hosted elsewhere (such as a third-party registrar or cloud provider), enabling DKIM requires publishing specific CNAME records that point to one.com’s signing hosts.

The exact number of records depends on your domain’s migration status on the platform:

  • For non-migrated domains, DKIM requires 4 CNAME records.
  • For migrated domains, DKIM required 2 CNAME records.

Because the hostnames and target destinations are unique to each domain, one.com does not publish generic record values. You must contact one.com support directly to retrieve your specific records: add the number of new CNAME records using the values you need for your domain, provided by our support. Never invent or copy CNAME targets from third-party guides, as incorrect targets will invalidate your DKIM signatures.

3. Add the CNAME records at your external provider

Once you receive your 2 or 4 domain-specific CNAME records from one.com support, log in to your external DNS management panel and create each CNAME record exactly as instructed by support.

4. Wait for DNS propagation

After saving your new CNAME records at your external DNS host, global DNS servers require time to update across the internet. According to one.com: It usually takes up to 240 minutes for this DNS change to propagate across the internet.

Verify the result

To verify that your outgoing email headers contain valid DKIM signatures and that your DNS records resolve correctly, check your domain using the free MXAudit scanner. MXAudit performs an exhaustive check across SPF, DKIM, and DMARC simultaneously.

You can also query your domain’s DKIM selector directly via the terminal (once you know the exact selector provided by support):

dig CNAME selector._domainkey.example.com +short

The returned hostname must point to one.com’s canonical signing target.

Common mistakes

Using generic or third-party CNAME targets. Because one.com assigns CNAME targets based on domain architecture and migration status, copying values from unofficial tutorials will break signature verification. Always request your 2 or 4 exact CNAME records from one.com support.

Attempting manual configuration on internal nameservers. If your domain uses one.com’s default nameservers, attempting to add manual DKIM keys or selectors in your Control Panel is unnecessary and can conflict with the platform’s automated rotation.

Not waiting the full propagation window. Because CNAME additions can take up to 240 minutes (240 minutes) to distribute across global DNS caches, testing right after saving often reports temporary verification errors.

Further reading