How to set up DKIM on Timeweb

Publish the DKIM key from your email provider in your Timeweb DNS so your emails carry a tamper-proof signature.

Why this matters to your business

DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send. The receiving mail provider uses a public key you’ve published in your DNS to confirm two things: the message really came from your domain, and nobody altered it on the way.

In plain terms: DKIM is a seal of authenticity on your email. It makes impersonation harder and improves the chance your genuine mail reaches the inbox rather than spam. It’s free and it’s a one-time setup.

Important: DKIM has two halves

Your email provider generates the key. Whoever runs your mailboxes — Timeweb Mail, Google Workspace, Microsoft 365, or another service — creates the DKIM key for your domain, along with a selector name (the label that identifies the key). You cannot make this value up.
Timeweb publishes it. You then add that key to your domain’s DNS at Timeweb, the company running your nameservers.

Using Timeweb Mail? Timeweb’s docs say DKIM is configured automatically for delegated domains once a mailbox is created and the first message is sent — check your DNS editor for an existing ..._domainkey record before adding anything. The steps below are for publishing a key from a third-party mail service.

Confirm Timeweb runs your DNS

A DKIM record only works if it’s added wherever your domain’s nameservers point, and Timeweb’s DNS editor only affects domains delegated to Timeweb’s nameservers. If your nameservers point elsewhere (Cloudflare, another host, your email provider), add the DKIM record there instead.

Get the records from your email provider

Before touching DNS, collect the DKIM details from whoever runs your email:

Google Workspace: in the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, generate the key, and copy the selector (usually google._domainkey) and the long TXT value beginning v=DKIM1; k=rsa; p=.
Microsoft 365: Microsoft uses two CNAME records named selector1._domainkey and selector2._domainkey, each pointing at a long ...onmicrosoft.com target.
Another provider: look in its email or DNS setup area for the DKIM record and copy the host and value exactly.

Note whether you were given TXT or CNAME records — you’ll choose the matching type below.

Step-by-step on Timeweb

Panel labels below are the Russian originals with English equivalents.

Sign in and go to «Домены и SSL» (Domains and SSL) → «Мои домены» (My domains); in the Timeweb Cloud panel, open «Домены и SSL» and your domain’s DNS tab.
Click the row with your domain and open the «Редактор DNS» (DNS editor) tab.
Click «Добавить запись» (Add record).
Set the type to match what your provider gave you — TXT for most providers, or CNAME for Microsoft 365.
In the «Хост» (Host) field, enter the selector part — for example google._domainkey or selector1._domainkey. Timeweb’s docs show selector hosts like default._domainkey entered this way, without the domain on the end; if your panel shows the record differently after saving, confirm in your console.
In the «Значение» (Value) field, paste the value your provider gave you:
- For a TXT record, the long key beginning v=DKIM1;.
- For a CNAME record, the target host (the ...onmicrosoft.com address).
Save. For Microsoft 365, repeat for the second selector.

Timeweb quirks people get wrong

Check for an auto-created record first. With Timeweb Mail, DKIM may already be in the zone. A duplicate or conflicting selector record breaks validation — edit rather than double up.
Right record type. Google Workspace gives you a TXT record; Microsoft 365 gives you two CNAME records. Adding the wrong type means DKIM never validates.
Don’t put the full domain in Host. If the provider shows google._domainkey.yourdomain.com, enter only google._domainkey — the domain is appended for you.
Paste the whole key — it’s long. DKIM public keys are hundreds of characters. Make sure nothing is cut off and no stray spaces or line breaks crept in.
Finish at the provider too. Some providers (Google included) require you to come back and click a button to start signing after the record is live.
Give it time. DNS changes can take minutes up to a couple of hours before DKIM starts validating.

Verify it worked

After publishing the record (and switching DKIM on at your provider, if required), run the free check on this site. It will confirm in plain language whether your DKIM record is published and readable.

See the full fix guide →

Done? Check your domain free to confirm it worked — and see your full grade across all 34 checks.