Last updated: July 2026

In short: After this guide OVHcloud signs your outgoing mail with DKIM. Receiving servers can then confirm your messages weren’t altered in transit — and that they really come from your domain.

Prerequisites

  • An OVHcloud email offer (MX Plan, Email Pro, Exchange, or Zimbra)
  • Access to the OVHcloud Control Panel
  • For the automatic route: the domain’s DNS zone at OVHcloud

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. OVHcloud puts it succinctly: the DKIM “record allows you to sign emails to prevent identity fraud”. The sending platform signs the message with a private key; the matching public key lives in your DNS zone, so any receiver can verify the signature. If the message is altered in transit, the signature no longer matches and the DKIM check fails.

The link between key rotations and DNS is the selector. It appears in the message header after s= — for OVHcloud email a selector looks like s=ovhex123456-selector1. Together with SPF and DMARC, DKIM forms the authentication trio large receivers now expect.

The starting point at OVHcloud

The good news: OVHcloud does the heavy lifting. “Automatic DKIM configuration is available for all our email offers” — MX Plan, Exchange, Email Pro, and Zimbra. When you attach a domain to an OVHcloud email solution, the “automatic DKIM configuration is proposed and performed by default if you do not disable it”. In other words, for a fresh OVHcloud mailbox on an OVHcloud-hosted domain, DKIM is usually already active.

Two situations need a manual step: DKIM wasn’t enabled when the domain was added, or the domain’s DNS lives outside OVHcloud.

Step-by-step guide

1. Check whether DKIM is active

The easiest way is to drop your domain into the free MXAudit scanner — it looks for a valid DKIM signature and public key. If you already know the selector, you can also check in the terminal:

dig TXT selector._domainkey.example.com +short

2. Enable DKIM for an OVHcloud mailbox

If DKIM wasn’t switched on automatically, turn it on in the Control Panel. For MX Plan: open Web Cloud, click MX Plan, select the domain, and open the General information tab. In the General information box, DKIM shows in red in the Diagnostic column. As OVHcloud puts it: “To enable DKIM, simply click on the red” DKIM badge and then click Validate. Exchange, Email Pro, and Zimbra follow the same pattern in their respective sections.

3. Domain on external DNS: the two CNAME records

If your domain is not managed in the same OVHcloud Control Panel — or is registered outside OVHcloud entirely — the activation window changes. OVHcloud states: “This window asks you to enter two CNAME values in the DNS zone of the domain name, which links this domain name to the DKIM selectors of your email service.” You copy those two CNAME targets into your external DNS provider, wait for them to propagate, and only then click Enable.

The CNAME approach is deliberate: it lets OVHcloud rotate keys for you. During a rollover “the old pair must remain active until all emails you sent with the old key fail to pass the DKIM check on the incoming server” — as long as the CNAMEs point at OVHcloud’s selectors, you always resolve to the current key without touching your zone again.

4. Wait until the change is live

DNS changes take time: depending on TTL and caching it can take a few hours until every receiving server sees the new keys.

Verify the result

Check your configuration with the free MXAudit scanner — it shows DKIM, SPF, and DMARC at a glance. Or send a test mail to yourself and inspect the header: a valid DKIM-Signature: line with a d= matching your domain means signing works.

Common mistakes

Expecting DKIM without an OVHcloud email offer. Automatic signing is tied to an OVHcloud mailbox (MX Plan, Email Pro, Exchange, Zimbra). If you send through an external ESP, that provider gives you its own DKIM record to publish.

External DNS, no CNAMEs. If your domain uses nameservers outside OVHcloud, the automatic activation can’t write into your zone. As OVHcloud notes, “If your domain name does not use OVHcloud DNS servers, you will need to modify the DKIM records in the interface of the service provider that manages your domain name configuration” — that’s where the two CNAMEs go.

Copying keys as static TXT instead of CNAME. Replicate OVHcloud’s selectors as rigid TXT records and you get stuck on an old key when OVHcloud performs a rollover. The CNAME variant keeps you on the current key automatically.

DKIM alone. A DKIM signature only proves integrity and origin — it does nothing about policy. Pair it with SPF and a DMARC record so receivers know what to do when a check fails.

Further reading