How to set up DKIM on Beget

Publish the DKIM key from your email provider in your Beget DNS so your emails carry a tamper-proof signature.

Why this matters to your business

DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send. The receiving mail provider uses a public key you’ve published in your DNS to confirm two things: the message really came from your domain, and nobody altered it on the way.

In plain terms: DKIM is a seal of authenticity on your email. It makes impersonation harder and improves the chance your genuine mail reaches the inbox rather than spam. It’s free and it’s a one-time setup.

Important: DKIM has two halves

Your email provider generates the key. Whoever runs your mailboxes — Beget’s own mail, Google Workspace, Microsoft 365, or another service — creates the DKIM key for your domain, along with a selector name (the label that identifies the key, e.g. google or us). You cannot make this value up.
Beget publishes it. You then add that key to your domain’s DNS at Beget, the company running your nameservers.

If you use Beget’s own mail hosting, Beget’s help covers setting up the DKIM signature for mail sent through its servers — start from Beget’s knowledge-base article on DKIM/SPF/DMARC records. If you send through a third-party service, follow the steps below to publish the key it gives you.

Confirm Beget runs your DNS

A DKIM record only works if it’s added wherever your domain’s nameservers point. If your domain uses Beget’s nameservers (the default for domains registered or hosted at Beget), you’re in the right place. If the nameservers point elsewhere (Cloudflare, another host, your email provider), add the DKIM record there instead.

Get the records from your email provider

Before touching DNS, collect the DKIM details from whoever runs your email:

Google Workspace: in the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, generate the key, and copy the selector (usually google._domainkey) and the long TXT value beginning v=DKIM1; k=rsa; p=.
Microsoft 365: Microsoft uses two CNAME records named selector1._domainkey and selector2._domainkey, each pointing at a long ...onmicrosoft.com target.
Another provider: look in its email or DNS setup area for the DKIM record and copy the host and value exactly.

Note whether you were given TXT or CNAME records — you’ll choose the matching type below.

Step-by-step on Beget

In Beget, a record on a host like google._domainkey.yourdomain.com lives on a subzone, which you create first. Labels below are the Russian originals with English equivalents; confirm exact wording in your console.

Sign in to the Beget control panel and open the DNS section.
Select your domain in the list at the top.
Click «Добавить подзону» (Add subzone) and create a subzone named after the selector host — for example google._domainkey or selector1._domainkey. Enter only the selector part; Beget appends your domain automatically.
Select the new subzone, then click «Открыть режим редактирования» (Open editing mode).
In the «Быстрое добавление» (Quick add) block, set the record type to match what your provider gave you — TXT for most providers, or CNAME for Microsoft 365.
Paste the value into the data field:
- For a TXT record, the long key beginning v=DKIM1;.
- For a CNAME record, the target host (the ...onmicrosoft.com address).
Save. For Microsoft 365, repeat with a second subzone for selector2._domainkey.

Beget quirks people get wrong

The selector host is a subzone, not a field. Unlike panels with a free-form “Host” box, in Beget you create the ..._domainkey subzone first, then attach the record to it. Skipping the subzone step is the most common failure.
Don’t put the full domain in the subzone name. Enter google._domainkey, not google._domainkey.yourdomain.com — Beget adds the domain for you, and doubling it up creates a broken host.
Right record type. Google Workspace gives you a TXT record; Microsoft 365 gives you two CNAME records. Adding the wrong type means DKIM never validates.
Paste the whole key — it’s long. DKIM public keys are hundreds of characters. Make sure nothing is cut off and no stray spaces or line breaks crept in.
Finish at the provider too. Some providers (Google included) require you to come back and click a button to start signing after the record is live.
Give it time. DNS changes can take minutes up to a couple of hours before DKIM starts validating.

Verify it worked

After publishing the record (and switching DKIM on at your provider, if required), run the free check on this site. It will confirm in plain language whether your DKIM record is published and readable.

See the full fix guide →

Done? Check your domain free to confirm it worked — and see your full grade across all 34 checks.