How-to · Intermediate · 15 minutes
How to Set Up DKIM Signing
Everything you need to sign your outgoing mail so that tampering and spoofing both show up — the steps in order, the snag to watch, and the tip our support desk gives everybody.
Straight answer first
The job: sign your outgoing mail so that tampering and spoofing both show up. Time to allow: 15 minutes. Skill needed: intermediate.
The walkthrough below covers every step, the mistake most people make, and the shortcut worth keeping. On Hosting Seller plans several of these steps are already done for you, and we say where.
Written by the Hosting Seller staff · Checked 1 August 2026
Intermediate
Skill needed
5
Stages to finish
Free
Help included
Tested
On our own kit
You do not need to be technical for this. The walkthrough is written for first-timers, tested on our own platform, and honest about which parts are genuinely fiddly and which are merely unfamiliar.
One promise before you start: nothing in this guide is irreversible. Where a step could bite, we say so and give you the undo.
The whole job at a glance
The job breaks into a few clear stages: switch dkim on in the panel, publish the selector record itself, repeat for each sending service, prove the signature end to end and then leave the keys alone.
Each stage is a few minutes of steady clicking — the time it takes depends mostly on how familiar the control panel already feels. The detailed steps sit further down this page; skim the whole route once before you begin.
Where this goes wrong, and how not to
Enabling DKIM in the panel while DNS is answered somewhere else entirely. Your mail goes out signed and pointing at a public key nobody can fetch, so every check fails as 'key not found' until the record is published where it belongs.
Forewarned really is forearmed here. This one mistake accounts for most of the frustration the subject produces, and it is entirely avoidable once somebody names it.
One habit that makes this easy for good
DKIM keeps working through forwarding, which is exactly where SPF falls down. That is why both exist: the signature travels inside the message itself, while SPF only ever judges the server that made the final delivery.
It costs a minute now and pays that back every time the job comes round again — which, like most hosting jobs, it certainly will.
What you can skip on a Hosting Seller plan
Several steps in this guide exist only because hosting historically made you do them. On our plans SSL issues itself, backups run daily without being asked, and one-click installers replace the manual setup entirely. What is left is the part that is genuinely yours.
And when a step misbehaves anyway, support answers at any hour with the actual fix, not a knowledge-base link and a shrug. Half our best guides began life as a pattern in the ticket queue.
Why the job is simpler on our plans
Every walkthrough on our how-to shelf is tested on the platform we actually run — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen instead of gesturing vaguely at it.
SSL comes free with every plan and reissues itself before it lapses, so nobody has to diary the padlock.
- Step by step, tested exactly as printed
- The snag flagged before you reach it
- The dull steps are already automated
- People on hand at any hour if you stall
Why Hosting Seller
On every plan, as standard
No jargon toll
Terms are explained where they appear or linked to the glossary — nothing assumes you already know.
Written from real tickets
Our guides come off the support desk, so the snags flagged here are the ones people genuinely hit.
5 steps, no filler
Each stage is a few minutes of steady clicking, with the fiddly parts marked as fiddly.
Help on the counter
Stuck on step three at midnight? Support answers at any hour, mid-guide included.
Works exactly as written
Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.
Automation where it belongs
SSL, backups and installs run themselves here, so the guide covers only what is genuinely yours to do.
First Steps
From choosing to live
- 1
Switch DKIM on in the panel
cPanel's Email Deliverability screen generates the key pair and shows you the exact DNS record needed. On our hosting it is frequently a single Install button and nothing more besides.
- 2
Publish the selector record itself
The public half of the key goes into a TXT record at selector._domainkey.yourdomain. When DNS is hosted here the panel writes it for you; when it is elsewhere you add it by hand.
- 3
Repeat for each sending service
Newsletter platforms and CRMs sign with their own keys and hand you their own selector records, often as CNAMEs. Add each one alongside the others; they coexist without argument.
- 4
Prove the signature end to end
Send a message to a mail-testing service, or open the headers on one delivered to Gmail. What you are looking for is dkim=pass showing your own domain rather than someone else's.
- 5
Then leave the keys alone
DKIM keys are not passwords to be rotated nervously. Change them when one is compromised or when you migrate providers, not on a schedule that keeps breaking alignment for no benefit.
In the Box
Packed with every plan
- A 99.9% uptime commitment, watched by monitoring day and night
- WebP image optimisation built in and costing nothing
- A 30-day money-back guarantee on every hosting plan
- Nothing added at setup — no joining fee, ever
- Webmail in the browser plus IMAP, POP and SMTP for your own client
- The renewal price printed on the tag matches the order price
- SSH, Git and Composer on the plans built for developers
- The Softaculous installer for one-click application setup
- Staging copies so changes get tested before they go live
- NVMe SSD storage on every shelf, not just the top one
Across the Counter
The questions we get asked most
What difference does DKIM make that anyone can see?
None at all to the person reading the message, and everything to the filters in front of them. A dkim=pass with your domain aligned feeds sender reputation and is what DMARC enforcement is built on. Its absence shows up as the spam folder.
Does every service sending as my domain need its own DKIM?
Yes. Every sender signs independently using its own selector, and multiple selectors sit side by side quite happily. The aim is that each legitimate stream of mail carries a signature a receiving server can verify.
Does hosting come with mailboxes?
It does — mailboxes on your own domain ship with every hosting plan, with webmail, IMAP, POP and SMTP access and spam filtering fitted as standard. There is also standalone email hosting for domains whose website lives somewhere else entirely.
Where do the servers actually sit?
Our hosting runs from European datacentres with London at the centre, behind server-level caching that keeps cached pages quick for visitors anywhere. For most sites the build of the platform — NVMe disks, LiteSpeed, sensible numbers of accounts per machine — decides the speed far more than the postcode does.
Is the SSL certificate genuinely free?
On every plan, with nothing held back. The certificate is issued the moment your domain points here and reissues itself well before expiry. The encryption is the same as a paid DV certificate — paid tiers exist only for wildcard coverage or organisation validation, which most sites never need.
Can I set the PHP version myself?
Yes — PHP versions are chosen per site from the control panel, so an old application and a current one can sit side by side on the same account. Extensions and per-site settings live in the same screen, and none of it needs a support ticket.
Can I test changes somewhere safe first?
Yes — plans with staging let you clone the live site, work on the copy, then push it across when you are satisfied. It is the difference between hoping an update behaves and knowing that it does before any customer meets it.
Read next
How to Use a WordPress Staging Site
Rehearse every risky change on a copy no visitor will ever see — beginner level, about 10 minutes to create, saves hours routinely.
How to Install a LAMP Stack
Linux, Apache, MySQL and PHP, serving real pages from a bare server — advanced level, about one hour.
Reseller Hosting
White-label hosting with WHM — sell under your own name and bill monthly.
Domain Names
Search, register and transfer names — year one free with annual hosting.
Packing up and moving host? Take our checklist.
A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.
Your site is worth better hosting.
From a first website to a rack of servers, moving up is a change to your account rather than a migration.
See the plans