Defaults.Exposed

Defaults.Exposed › Setup walkthroughs › DKIM › Namecheap

DKIM on Namecheap: where the key comes from and where it goes

The labels on your mail provider’s DKIM (DomainKeys Identified Mail) page don’t line up with the fields on the Namecheap DNS (Domain Name System) screen. The key comes from whoever runs your mailboxes. The record goes into Namecheap’s Advanced DNS as a TXT (Text) row (or a CNAME, if your provider said so), the Host field takes the selector on its own, and the value goes in whole with no quotation marks around it.

What the signature does

DKIM (DomainKeys Identified Mail) attaches a signature to each message your domain sends. The receiving server reads a selector name out of the message header, looks up the matching public key in your DNS, and checks that the signature fits the content it received. If it fits, the receiver knows two things: the mail came from a system holding your private key, and nobody altered it on the way.

Receivers take that into account when they decide on inbox placement, and your DMARC (Domain-based Message Authentication, Reporting and Conformance) policy depends on the same result. Publishing the key costs nothing, and you set it up once per mail provider, with the mailboxes under it sharing the key.

Two halves, two places

DKIM is the record where it matters who does which part. Your mail provider (Google Workspace, Microsoft 365, or whoever hosts your mailboxes) generates the key pair inside its own admin console, keeps the private half, and hands you the public half. Namecheap’s only role is to publish that public half in DNS so receivers can find it.

You can’t borrow a value from another domain or from a screenshot in a forum thread. The private key that signs your mail belongs to the pair your provider generated, so only the matching public key will verify it, and that’s why the generating happens in the mail platform and the publishing happens at Namecheap.

Check that Namecheap answers DNS for your domain

Before you add anything, confirm that receivers will be reading records from Namecheap in the first place. A DKIM record only works where your domain’s nameservers point. In Namecheap, go to Domain List, click Manage next to the domain, and look at the Nameservers section. If it says Namecheap BasicDNS or Namecheap PremiumDNS, this page is for you. If it shows anything else (a web host’s servers, or a custom set you or a previous admin entered), the record belongs at that provider, because receivers won’t read a row added at Namecheap.

This catches people because buying a domain and hosting its DNS are separate jobs, and Namecheap does both for some customers and only the first for others. In the October 2026 census, Namecheap’s nameservers answer for 10,125,644 domains, 3.10% of the domains that have nameservers. The Nameservers section on the Manage page tells you whether yours is one of them.

Get the two pieces from your mail provider

In the mail provider’s admin area, find the DKIM or email authentication setting and generate or enable a key for your domain. It gives you two strings.

The first is the host, sometimes labelled the selector or the record name. It looks like google._domainkey or selector1._domainkey. The part before ._domainkey is the selector, and it’s what a receiving server puts in front of your domain when it goes looking for the key.

The second is the value. For a TXT record it begins v=DKIM1; and continues k=rsa; p= followed by the public key itself, which runs to hundreds of characters with no spaces in it. For providers that use CNAME (Canonical Name) records (Microsoft 365 is one), the value is instead a hostname on the provider’s own servers, and the record type has to stay CNAME so that the lookup follows it back to them. Copy both strings exactly, and keep the provider’s page open until you’ve verified the result.

If the provider’s page shows more than one selector and you can’t tell which is live, finding your DKIM selector shows how to read it out of the headers of a message you’ve already sent.

Add the record in Namecheap

  1. Sign in, open Domain List, and click Manage next to the domain.
  2. Open the DNS settings for that domain. Depending on the account view this is labelled DNS, Records or Advanced DNS; it’s the tab holding a list of A, CNAME and TXT rows.
  3. Click Add New Record and choose the type your provider gave you. Most DKIM keys are a TXT Record. If the provider handed you a CNAME, choose CNAME Record and paste their target hostname as the value; converting it to TXT publishes a record no receiver can use.
  4. In the Host field, type the selector part only: google._domainkey, or selector1._domainkey. Namecheap appends your domain by itself. If your provider’s instructions show selector1._domainkey.yourdomain.com, you still enter selector1._domainkey, because typing the full name produces a doubled host ending in .yourdomain.com.yourdomain.com that no receiver will query.
  5. In the Value field, paste the value whole. Compare the last few characters against the provider’s page, since a copy that stops early, or that picked up a stray space or a line break in the middle, publishes a key that won’t verify. Don’t wrap the value in quotation marks; Namecheap applies the quoting when it saves the row, and quotes you type become part of the record and corrupt it.
  6. Leave the TTL (Time to Live) set to Automatic.
  7. Save the record and check it appears in the list.

The selector you typed in Host has to match what the provider signs with, character for character, because the receiver uses that exact string to find the key. selector1 and selector2 are different lookups, and so are google and google1. If the provider offers a choice of selector during setup, use whatever appears on the page you’re copying from, and don’t rename it to something tidier.

The same Advanced DNS tab holds your SPF record, which most providers ask you to set up in the same sitting. That one is a separate TXT row at Host @, so keep the two apart and don’t paste the SPF (Sender Policy Framework) text into the DKIM row or the other way round.

Confirm it published

A new record isn’t visible to the world the instant you save it. Namecheap’s own servers pick it up within minutes as a rule, but resolvers elsewhere may hold an older answer for up to a couple of hours, so a check run straight after saving can read as absent when nothing is wrong. Give it a little time, then run the free scan against your domain; it looks up the record the way a receiving mail server would and tells you whether the key is published and readable.

How the scan grades this record: the DKIM check, with its pass and fail rules and how many domains pass it.

There’s no way to list the DKIM records on a domain, so any checker, this one included, has to ask for a specific selector by name, and it can only ask for the selectors it knows to try. If your provider uses an unusual selector, a scan may report the key as not determinable instead of absent. That’s a limit of the lookup, and it doesn’t mean your record is wrong. The census has the same limit: of the 76,563,365 domains where it could run the DKIM check, it found a selector on 38,666,798 (50.5%), and found no key at any selector it tried on the other 37,896,567 (49.5%). That second group includes the domains whose keys sit under a selector the census doesn’t try.

So if your scan comes back blank, check the selector spelling in Host first, then the nameservers, then wait out propagation. If all three are right and the key still doesn’t verify, send a message from the domain to a mailbox you control and open the DKIM-Signature header: the s= tag is the selector your provider is signing with, so that’s the string the Host field needs to match. The DKIM guide explains what the rest of that header means and what a receiver does when the lookup fails.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.