DKIM: generate, publish, verify

DKIM lets you generate a key pair in cPanel, publish the public half as a DNS TXT record, and confirm that outbound mail shows dkim=pass. Prefer a 2048-bit key. The receiving server fetches your public key from DNS and checks the signature over the body and the headers you signed. Without a published key, a local signature does not help deliverability or DMARC.

You normally use one of two patterns: a TXT record from cPanel on this server, or a CNAME that points at a mail provider’s key. Do not put two different keys on the same selector.

Generate and publish the cPanel key

If mail for the domain leaves this server, open cPanel Email Deliverability and enable DKIM for that domain. cPanel will show a TXT name, often default._domainkey, and a long value. Create that TXT record at the DNS that actually answers for the domain, whether that is cPanel DNS, Cloudflare, or another host pointed to by your nameservers. After the record is live, send a test message to an inbox you control and open the raw headers. You want dkim=pass with a domain that matches your From address.

dig +short default._domainkey.example.com TXT

Empty output means the selector is not in public DNS yet. The server may still sign with a private key that nobody can fetch, so verification fails and DMARC alignment fails even when SPF passes. Publish the 2048-bit key cPanel gave you and wait for DNS TTL before you retest.

When a provider CNAME is the right path

If Google Workspace, an ESP, or another service sends as your domain, they usually ask for a CNAME such as s1._domainkey.example.com to a name they host. That is the correct path for mail that leaves through them. Use their selector and their instructions. Do not also enable a conflicting cPanel key on the same selector, or you will mix two stories and confuse the next person who reads the zone.

cPanel DKIM is the wrong tool when this domain’s mail never leaves this server. A vendor CNAME alone is the wrong tool when mailboxes on this server must sign as well. In that mixed case you need two selectors, two records, and a clear note about which path uses which key.

Verify with the message headers

After publish, wait for TTL, then send a real message. Read Authentication-Results in the headers rather than a dashboard status light. The pair you want is dkim=pass with d= matching the From domain. A pass from a vendor domain on a message From your domain is a valid signature that still does not help DMARC alignment. That difference is covered in DKIM alignment versus a passing signature.