DKIM for Multiple Senders: Key Management Guide

Modern organizations send email from many sources: marketing from Mailchimp, support tickets from Zendesk, transactional emails from SES, and internal mail from Google Workspace. Each needs its own DKIM configuration.

How Multiple DKIM Keys Work

DKIM selectors make multiple keys possible. When an email is signed, the selector tells receivers where to find the public key:

DKIM-Signature: d=yourdomain.com; s=mailchimp; ...

The receiver looks up: mailchimp._domainkey.yourdomain.com

This means:

• Each service can have its own key pair
• Keys don't conflict with each other
• You can rotate keys for one service without affecting others
• Failed signatures from one service don't impact other services

Common Multi-Service Scenarios

Marketing + Transactional + Corporate Email

E-commerce Stack

SaaS Application

Setting Up Multiple Services

DNS Record Example

For a domain using Google Workspace, Mailchimp, and a custom application:

; Google Workspace
google._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIIBIj..."

; Mailchimp
k1._domainkey.yourdomain.com     TXT  "v=DKIM1; k=rsa; p=MIGfMA0..."

; Custom application
app._domainkey.yourdomain.com    TXT  "v=DKIM1; k=rsa; p=MIIBIjA..."

All three records exist simultaneously. Each service's emails will be verified against its specific key.

Services That Need Custom Keys

Some services don't provide DKIM or require you to bring your own:

• Self-hosted applications (custom code sending via SMTP)
• Older on-premise software
• Some CRM and ticketing systems
• Custom marketing automation

For these, use DKIM Creator to generate keys, then configure the service with the private key.

DMARC Alignment with Multiple Senders

DMARC requires alignment—the domain in the DKIM signature must match the From header domain.

Check alignment mode:

• relaxed (default): Subdomains are allowed
• strict: Exact match required

Subdomain strategy:

Some organizations use subdomains for clarity:

This isolates reputation—marketing issues don't affect transactional delivery.

Monitoring Multiple Services

With multiple DKIM keys, monitoring becomes essential:

DMARC reports show which services are passing or failing:

<record>
  <source_ip>198.51.100.1</source_ip>
  <policy_evaluated>
    <dkim>pass</dkim>
  </policy_evaluated>
  <auth_results>
    <dkim>
      <domain>yourdomain.com</domain>
      <selector>mailchimp</selector>
      <result>pass</result>
    </dkim>
  </auth_results>
</record>

Per-service monitoring:

• Track bounce rates per sending source
• Monitor DKIM pass rates in email analytics
• Set alerts for authentication failures

Troubleshooting Multi-Service DKIM

One service failing, others passing

• Check that specific service's selector and DNS record
• Verify the service is configured to use your domain
• Check if the service requires domain verification

DMARC failures despite DKIM pass

• Alignment issue: DKIM domain doesn't match From domain
• Check if the service is signing with their domain instead of yours
• Some services require explicit custom domain configuration

Duplicate selector conflict

• Two services can't use the same selector
• Rename one (most services let you customize the selector)
• Or use subdomains to separate them

Best Practices

1. Maintain a selector registry — Document which service uses which selector
2. Use descriptive selectors — marketing2024, support, app are better than key1, key2
3. Plan for rotation — Include version or date in selectors for easier rotation
4. Separate by subdomain when sensible — Isolates reputation and simplifies management
5. Monitor DMARC reports weekly — Catch issues before they impact deliverability

---

Managing DKIM across multiple services? Generate custom keys when you need them.