How to Enable DKIM Signing for Your Domain in Plesk

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing email from your domain. Receiving mail servers use this signature to verify the message actually came from your domain and was not tampered with in transit. Enabling DKIM improves deliverability and helps prevent your messages from being flagged as spam.

Step 1: Open mail settings for your domain

1. Log in to Plesk.
2. Go to Websites & Domains and find your domain.
3. Click the Mail tab, then click Mail Settings.

Step 2: Enable DKIM signing

1. Select the checkbox Use DKIM spam protection system to sign outgoing email messages.
2. Click Apply (or OK).

If your domain uses the Plesk DNS server, DKIM is now active. Plesk automatically adds two DNS records to your domain zone:

• default._domainkey.yourdomain.com — the public key used to verify signatures.
• _domainkey.yourdomain.com — the DKIM policy.

Step 3: External DNS only — add records manually

If your domain uses an external DNS server (e.g. Cloudflare), Plesk cannot add the records for you:

1. After enabling DKIM, click the How to configure external DNS link that appears.
2. Copy the two DNS records shown.
3. Log in to your external DNS provider and add both as TXT records.
4. Save your changes. DNS propagation may take up to 24–48 hours.

Step 4: Verify DKIM is working

1. Send a test email from your domain to a Gmail or Outlook address.
2. Open the received email and view the message headers (in Gmail: three dots > Show original).
3. Look for DKIM=pass in the Authentication-Results header.

You can also use MXToolbox DKIM Lookup — enter default._domainkey.yourdomain.com as the selector.

Domain aliases

If you use domain aliases to send email, add the same DKIM DNS records for each alias. Use the same record values but replace the domain name with the alias name.

Important notes

• DKIM signing must be enabled at the server level by your hosting provider before you can activate it. If the checkbox is not visible, contact support.
• DKIM works best alongside SPF and DMARC. Together, these three form complete email authentication.
• Enabling DKIM does not affect incoming email — it only signs outgoing messages.
• New domains with DNS and mail hosting in Plesk may have DKIM on by default.

Troubleshooting

DKIM checkbox is not visible in Mail Settings:

• Your hosting provider has not enabled DKIM on the server. Contact them to request it.

Emails still show DKIM=fail after enabling:

• If you use external DNS, confirm the TXT records were added correctly using MXToolbox.
• DNS propagation can take up to 48 hours. Wait and test again.
• Verify the selector matches — Plesk uses default as the selector name.

DKIM works for the main domain but not for aliases:

• Add the DKIM DNS records for each domain alias separately using the same key values.

If you need help enabling DKIM, contact our support team.