Guide per DNS host

Set up DKIM at STRATO

DKIM signs outgoing mail with a key whose public part lives in DNS. At STRATO the key is generated in the control panel; if the name servers are at STRATO too, the DNS record is usually set automatically. This guide shows both steps and the mistakes that invalidate the signature.

Enable DKIM at STRATO

In the STRATO login open the domain under "Email" and enable DKIM; with STRATO name servers the key is added automatically.

With external name servers create the TXT or CNAME record shown there.

Other senders sign separately

Every service sending on behalf of the domain needs its own DKIM key with its own selector: the newsletter tool, the CRM, Microsoft 365. The records do not interfere because each lives under a different selector. DMARC then covers all of them.

How to add the DKIM record at STRATO

The way to the STRATO DNS editor:

  • In the STRATO customer login open "Domains" and then "Domain administration".
  • Choose "manage" next to the domain and switch to the "DNS settings" tab.
  • STRATO separates by type: "TXT and CNAME records" for SPF, DKIM, DMARC and verifications, "MX records" for mail delivery.
  • Type and name as shown by the mail provider: usually CNAME or TXT under selector._domainkey. The selector name goes before _domainkey, the host appends the rest of the domain.
  • Enter the value and save; propagation can take up to an hour.
  • For subdomain records such as _dmarc or selector._domainkey put the prefix into the "Subdomain" field, not into the value.

Typical mistakes at STRATO

  • Selector missing or misspelled in the name, so the receiver finds no key.
  • TXT value truncated for long keys or split into several records.
  • CNAME next to other records on the same name.
  • DKIM enabled in the control panel but the name servers are elsewhere and the record is missing there.

Verify and keep an eye on it

After saving, the change at STRATO usually applies within minutes. The checker below queries the authoritative name servers and shows right away whether the DKIM record is read correctly. DomainWarn keeps checking the record afterwards and alerts you when it changes or disappears, for example after a migration or one click too many in the DNS editor.

Frequently asked questions

Why does the checker find no DKIM record after enabling it at STRATO?
Either the name servers are not at STRATO and the record is missing there, or the selector differs from the common ones. Enter the selector name from the STRATO control panel in the DKIM checker.
Which key length is right?
2048 bits. 1024 bits is considered too short, longer keys do not fit every DNS editor.
Check now

Free DKIM record check and lookup: selector, key type, key length, syntax and revoked keys. Leave the selector empty to try common selectors automatically.

Selector is optional: leave it empty to check common selectors automatically.

DomainWarn checks SPF, DKIM, DMARC, DNS and certificates of all client domains regularly and reports changes before mail lands in spam.

Monitor this domain continuously14-day free trial, no credit card.

The same guide for other hosts