Last updated: July 2026

In short: After this guide Strato signs your outgoing email with DKIM — automatically with a standard setup, via two CNAME entries with your own nameservers.

Prerequisites

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing email. The receiving mail server fetches the public key from the sender domain’s DNS and uses it to verify the signature — this lets it check that the mail really comes from your domain and wasn’t altered in transit.

For context: while SPF authorizes the server, DKIM secures the message. Only together with DMARC does it make a solid foundation.

The starting point at Strato

The good news: if you send via the Strato mail servers (smtp.strato.de), Strato has signed your mail automatically with DKIM for years. For the normal case you don’t have to do anything at all.

You need to get hands-on in two situations:

  1. You use an external sending service (ESP) — a newsletter tool, say. Then the ESP often requires its own DKIM entry and gives you a selector and key for it. You enter this at Strato as a TXT record.
  2. You run your own nameservers but want to keep sending via Strato. Then you have to replicate the DKIM selectors yourself as CNAMEs (step 4).

A technical treat on the side: Strato publishes its keys in two variants at once — a classic RSA key (strato-dkim-0002) and a modern Ed25519 key (strato-dkim-0003). Both are live and retrievable in DNS.

Step-by-step guide

1. Check whether DKIM is active

The easiest way is to drop your domain into the free MXAudit scanner — it recognizes the Strato selectors and shows whether signing happens. In the terminal, if you know the selector:

dig CNAME strato-dkim-0002._domainkey.example.com +short

2. Standard setup: do nothing

If your sending runs via smtp.strato.de and your nameservers are at Strato, DKIM is active. Jump to Verify the result.

3. Open the DKIM settings (for ESP entries)

If an external service requires its own DKIM entry: log into the customer login, open the Domain management, click the gear icon for the domain, then DNS → Manage TXT and CNAME records. Here you enter the selector and key provided by the ESP.

Note Strato’s character rules for the input field: allowed are lowercase a-z (no umlauts), digits 0-9, and the special characters -+*._.

4. Your own nameservers: the CNAME selectors

If you run your own nameservers but want to keep Strato’s DKIM signing, you create two CNAME records pointing to the Strato selectors:

strato-dkim-0002._domainkey.example.com.  CNAME  strato-dkim-0002._domainkey.rzone.de.
strato-dkim-0003._domainkey.example.com.  CNAME  strato-dkim-0003._domainkey.rzone.de.

The advantage of the CNAME approach: Strato can perform a key rollover to new selectors at certain intervals — as long as the CNAMEs are in place, you get the new keys automatically, without replicating them yourself.

5. Wait until the change is live

DNS changes take time: depending on TTL and caching it can take a few hours until every server sees the new entry.

Verify the result

Check your configuration with the free MXAudit scanner — it shows you DKIM, SPF, and DMARC at a glance.

Common mistakes

Your own TXT entry despite standard sending. If you send via smtp.strato.de, you don’t need your own DKIM record — Strato already signs. An additional, poorly maintained entry is more likely to cause harm.

ESP key in the wrong domain. The DKIM entry belongs in the domain used as the sender (From:) — not in the ESP’s domain. The ESP tells you the exact selector.

Ignored key rollover. If you copy the selectors once as a rigid TXT instead of a CNAME, you get stuck on an old key when Strato rotates. With your own nameservers, use the CNAME variant.

Umlauts or uppercase in the selector. Strato’s input field only accepts lowercase a-z, 0-9, and -+*._ — other characters cause errors.

Further reading