--- title: "Read This Before Adding Multiple DKIM Records To Your Domain | DMARC Report" description: "Learn when adding multiple DKIM records makes sense, how to avoid common configuration errors, and ensure secure email authentication and deliverability." image: "https://dmarcreport.com/og/blog/read-this-before-adding-multiple-dkim-records-to-your-domain.png" canonical: "https://dmarcreport.com/blog/read-this-before-adding-multiple-dkim-records-to-your-domain/" --- Quick Answer You can safely add multiple DKIM records to a domain as long as each uses a unique selector. This is common when using multiple email providers or rotating keys. Proper configuration prevents authentication failures and helps maintain email deliverability. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Read%20This%20Before%20Adding%20Multiple%20DKIM%20Records%20To%20Your%20Domain&url=undefined%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F&title=Read%20This%20Before%20Adding%20Multiple%20DKIM%20Records%20To%20Your%20Domain "Share on Reddit") [ ](mailto:?subject=Read%20This%20Before%20Adding%20Multiple%20DKIM%20Records%20To%20Your%20Domain&body=Check out this article: undefined%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F "Share via Email") ![Multiple DKIM Records](https://media.mailhop.org/dmarcreport/spf-validator-4875-1786018824462.jpg) ## Try Our Free DKIM Lookup Auto-discover DKIM selectors for any domain - scan 185 common selectors across all major providers. [ Discover DKIM Selectors → ](/tools/dkim-lookup/) Using multiple email services like Google Workspace, Microsoft 365, SendGrid, or Mailgun? Then you may need multiple DKIM records for your domain. Whether you’re managing email authentication manually or using [DMARCReport](https://dmarcreport.com/) to monitor your domain’s email security, understanding how multiple DKIM records work is essential. While having more than one DKIM record is perfectly normal, configuring them incorrectly can lead to authentication failures, poor email deliverability, and DMARC issues. Before adding additional DKIM records, it’s important to understand how DKIM selectors work and why each selector must have its own unique DNS record. This guide explains everything you need to know to configure multiple DKIM records correctly and avoid common mistakes. ## What DKIM Records Do and Why Multiple Records May Be Needed DomainKeys Identified Mail, commonly known as DKIM, is an email authentication method that helps prove an email message was authorized by the domain it claims to represent. It works through email message signing: an outgoing email server applies a DKIM signature using a private key, and the receiving server checks that signature against a [public key](https://www.techtarget.com/searchsecurity/definition/public-key) published in DNS. A DKIM record is usually **published as a TXT record** under a selector-based subdomain, such as: `may10._domainkey.example.com` In this example, may10 is the [DKIM selector](https://dmarcreport.com/blog/what-is-the-difference-between-dkim-selector-and-domain-checking-dkim/), `_domainkey` is the required namespace, and example.com is the sending domain. _The TXT record contains the public key, while the private key remains on the email server or within the email delivery service that signs the message_. Organizations often need multiple DKIM records because they use more than one email platform or mail stream. For example, Google Workspace may handle employee mail, Microsoft 365 may support executive communication, SendGrid may send [transactional email](https://help.brevo.com/hc/en-us/articles/7922954371858-What-is-a-transactional-email), and Mailgun may support product notifications. Meanwhile, CRM systems, support or ticketing tools, billing systems, Help desk systems, and marketing automation platforms may all send mail using the same domain. In modern email infrastructure, multiple DKIM records are normal. They help **distribute email senders safely** across third-party applications, productivity suites, transactional mail systems, and regional sending infrastructure without forcing every email server to share the same private key. ### DKIM in the broader email authentication stack DKIM is only one part of email authentication. A domain may also publish an SPF record to define authorized sender IP addresses and a DMARC record to define **policy and reporting for authentication** outcomes. Together, [SPF](https://dmarcreport.com/blog/how-spf-can-help-organizations-in-improving-email-security-and-thwarting-spam-phishing-and-email-spoofing/), DKIM, and DMARC improve email security and help receiving systems determine whether a message is legitimate. ![The Key Rule: One DKIM Record per Selector, Not Multiple Records on the Same Selector](https://media.mailhop.org/dmarcreport/dmarc-lookup-2357-1786013684091.jpg) DKIM is especially valuable because the digital signature survives many forwarding scenarios where SPF may fail. When DomainKeys Identified Mail is configured correctly, DKIM validation confirms that the message was signed by a trusted [email server](https://www.axigen.com/articles/what-is-an-email-server%5F107.html) and that important message headers were not altered after signing. ## The Key Rule: One DKIM Record per Selector, Not Multiple Records on the Same Selector _The most important rule is simple: you can have multiple DKIM records on a domain, but each DKIM selector must point to only one valid DKIM DNS record_. A DKIM selector is a label that tells the receiving server where to find the public key. If an email has a DKIM signature with s=may10, the receiving server **looks up the DNS record** at: `may10._domainkey.example.com` That DNS record should return one DKIM TXT record containing one public key. If you publish two different TXT record values for the same DKIM selector, you may create a record conflict or duplicate DNS entry. That can cause DKIM validation to fail, depending on how the receiving server handles the response. ### How selectors prevent record conflicts Selectors allow one domain to support multiple DKIM records cleanly. Instead of placing every DKIM key at the same DNS name, each sending source gets its own DKIM selector and record mapping. For example: - `workspace._domainkey.example.com` for Google Workspace - `mktg._domainkey.example.com` for a marketing platform - `support._domainkey.example.com` for a support system - `marketing-us._domainkey.example.com` for regional sending infrastructure - `july29._domainkey.example.com` for key rotation Each selector string maps to a distinct TXT record or, in some vendor configurations, a [CNAME record](https://en.wikipedia.org/wiki/CNAME%5Frecord) that points to the vendor’s hosted DKIM key. This selector naming convention keeps multiple DKIM records organized and prevents two email delivery services from fighting over the same record type. #### TXT record versus CNAME record Many providers ask you to publish a TXT record containing the public key directly. Others, such as some configurations with SendGrid, Mailgun, Mimecast, or other email delivery services, may provide a **CNAME record that points** to their domain, where they manage the public key for you. ![Common Scenarios for Multiple DKIM Records Across Email Services](https://media.mailhop.org/dmarcreport/dmarc-record-5239-1786013726780.jpg) ##### Never share a private key between unrelated senders A private key should be treated as sensitive signing material. Do not copy the same private key across unrelated systems unless your security architecture explicitly requires it. Proper [key management](https://www.manageengine.com/glossary/what-is-key-management.html) means each email platform, mail server, or third-party application should generally have its own key pair and DKIM selector. ## Common Scenarios for Multiple DKIM Records Across Email Services Multiple DKIM records are common in real IT environments because most organizations do not send every message from one email server. _Different departments, tools, and vendors often send on behalf of the same domain_. ### Productivity suites and employee mail Google Workspace and Microsoft 365 are common sources of employee mail and business communication. Each platform may generate its own DKIM key and require a [DNS record](https://www.ibm.com/think/topics/dns-records) such as `workspace._domainkey.example.com`. The public key is published in DNS, while the private key remains with the outgoing email **server or hosted email platform**. ### Transactional and application-generated mail Transactional email often comes from systems such as SendGrid, Mailgun, billing systems, CRM systems, and internal applications. These messages may include password resets, invoices, account alerts, and product notifications. Each transactional mail stream should use its own DKIM selector so that **record verification and troubleshooting** are straightforward. For example, SendGrid might use a selector like s1, Mailgun may provide a different selector string, and an internal mail server may use may10 or july29 for key rotation. ### Marketing, support, and regional sending A marketing platform may use `mktg._domainkey.example.com`, while Help desk systems or support or ticketing tools may use `support._domainkey.example.com`. Larger organizations may also use regional sending infrastructure, such as `marketing-us._domainkey.example.com`, to separate campaigns by geography or vendor. This structure helps email security teams maintain a centralized sender inventory and understand which authorized sender is responsible for each mail stream. ## Risks of Misconfigured DKIM Records and How They Affect Authentication Misconfigured multiple DKIM records can damage email authentication outcomes and reduce trust with receiving servers. The most common issue is publishing more than one TXT record for the same DKIM selector. A duplicate DNS entry may cause a receiving server to retrieve multiple public key **values and fail DKIM validation**. Another common problem is placing the public key at the wrong selector-based subdomain. If the [DKIM signature](https://docs.mapp.com/docs/dkim-signature) says s=mktg, but the DNS record is published at `marketing._domainkey.example.com`, the receiving server will not find the expected DKIM record. ### Common DKIM configuration failures Typical failures include: - Using the wrong DKIM selector for the email platform - Publishing an incomplete or wrapped TXT record incorrectly - Creating a record conflict by adding two public key values under one selector - Confusing a TXT record with a CNAME record - Leaving an expired key active after key rotation - Removing a DNS record before the sending email server has stopped using it - Allowing a key compromise to go unresolved - Forgetting to update DKIM after migrating to a new email delivery service These issues can cause email authentication failures, DMARC alignment problems, and poor [inbox placement](https://www.activecampaign.com/blog/inbox-placement). In some cases, a valid SPF record may still pass, but a failed DKIM signature can affect DMARC results if SPF is not **aligned or if forwarding breaks SPF**. ### Security impact of weak key management DKIM depends on the relationship between the private key and public key. If the private key is exposed, an attacker may be able to sign unauthorized messages until the public key is replaced. _That is why key rotation, rapid key update procedures, and strong key management are essential_. ![Best Practices for Adding, Testing, and Managing Multiple DKIM Records](https://media.mailhop.org/dmarcreport/what-is-dmarc-2395-1786013771325.jpg) DomainKeys Identified Mail is not just a deliverability feature; it is also part of email security. Email security teams should know which DKIM selector belongs to which system, who owns the email server, when the DKIM key was created, and whether the record is still needed. ## Best Practices for Adding, Testing, and Managing Multiple DKIM Records Managing multiple DKIM records is mostly about discipline: use unique selectors, document every DNS record, test every change, and **remove obsolete keys carefully**. ### Use a clear selector naming convention Choose a selector naming convention that makes ownership obvious. For domain example.com, examples might include: - workspace for Google Workspace - m365 for Microsoft 365 - mktg for a [marketing automation](https://www.ibm.com/think/topics/marketing-automation) platform - support for a support system - may10 or july29 for key rotation events - marketing-us for regional sending infrastructure A readable DKIM selector helps administrators identify which email server or email delivery service owns the record. This is especially useful when multiple DKIM records are maintained by different teams. ### Maintain a centralized sender inventory Keep a centralized sender inventory that **includes each email platform**, DNS provider location, DKIM selector, record type, public key owner, [private key](https://www.investopedia.com/terms/p/private-key.asp) owner, and business purpose. Include CRM systems, billing systems, Help desk systems, marketing automation platforms, productivity suites, and any third-party application that sends on behalf of the domain. This inventory should also track whether the DKIM record is a TXT record or CNAME record, when record verification was completed, and who approved the sender as an authorized sender. ### Test before and after publishing Before changing production DNS, confirm the exact selector string and record value from the provider. After publishing, use a DKIM record checker, DNS lookup tool, or your organization’s DMARC monitoring platform to verify that the TXT record resolves correctly. Then send real test messages and inspect the headers. Look for: - A present DKIM signature - The expected DKIM selector - A successful DKIM validation result - Alignment **with the visible From domain** - Expected DMARC record behavior - No record conflict or duplicate DNS entry ![Mastering Multiple DKIM Records: A Guide to Seamless Email Authentication](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-2395-1786013907833.jpg) Testing is essential because [DNS propagation](https://www.digicert.com/faq/dns/what-is-dns-propagation), formatting issues, and provider-specific requirements can all affect authentication outcomes. ### Plan key rotation carefully Key rotation should be deliberate. _Create the new key pair, publish the new public key under a new DKIM selector, configure the outgoing email server to sign with the new private key, and only remove the old DNS record after messages signed with the old key are no longer in transit_. For example, an organization might move from the may10 selector to the july29 selector during a scheduled key update. This allows both multiple DKIM records to coexist temporarily without breaking DomainKeys Identified Mail validation. Proper key rotation reduces risk from an expired key, stale DKIM key, or suspected key compromise while preserving reliable [email authentication](https://dmarcreport.com/blog/a-basic-guide-to-email-authentication-for-legal-professionals/). ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F) [ ](https://twitter.com/intent/tweet?text=Read%20This%20Before%20Adding%20Multiple%20DKIM%20Records%20To%20Your%20Domain&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fread-this-before-adding-multiple-dkim-records-to-your-domain%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) - [ ![Best DMARC Reporting Tools in 2026: Honest Comparison](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-report-4236.jpg) Best DMARC Reporting Tools in 2026: Honest Comparison Intermediate ](/blog/best-dmarc-reporting-tools-2026/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)[ Intermediate 8m Best DMARC Reporting Tools in 2026: Honest Comparison Mar 25, 2026 ](/blog/best-dmarc-reporting-tools-2026/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Read This Before Adding Multiple DKIM Records To Your Domain","description":"Learn when adding multiple DKIM records makes sense, how to avoid common configuration errors, and ensure secure email authentication and deliverability.","url":"https://dmarcreport.com/blog/read-this-before-adding-multiple-dkim-records-to-your-domain/","datePublished":"2026-08-06T00:00:00.000Z","dateModified":"2026-08-06T00:00:00.000Z","dateCreated":"2026-08-06T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/read-this-before-adding-multiple-dkim-records-to-your-domain/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/spf-validator-4875-1786018824462.jpg","caption":"Multiple DKIM Records"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Read This Before Adding Multiple DKIM Records To Your Domain","item":"https://dmarcreport.com/blog/read-this-before-adding-multiple-dkim-records-to-your-domain/"}]} ```