Hosted DKIM lets Suped answer public DNS lookups for your DKIM selectors. Your email provider still holds the private key and signs outgoing email; Suped hosts the matching TXT or CNAME records that receiving servers look up.
How it works
You add one NS record that delegates the entire _domainkey.yourdomain.com namespace to Suped. Suped then serves each selector at selector._domainkey.yourdomain.com. After that one delegation, you can add, edit, and remove public DKIM records from the Suped dashboard without editing DNS each time.
Before you connect DNS
Add every existing DKIM selector to Suped before changing the NS record. The delegation moves the whole _domainkeynamespace to Suped. Any selector that exists only at your current DNS provider will stop resolving after the change, which can cause DKIM verification to fail.
- Collect every TXT and CNAME record below
_domainkey.yourdomain.com. - Check each sending provider for selectors that may not be obvious in your current DNS view.
- Keep the current records in place until their equivalents have been added to Suped.
Set up hosted DKIM
- Go to Settings > Domains. If you are in an MSP parent organization, first open Organizations and switch to the child organization that owns the domain.
- Open the three-dot menu for the domain and select Configure DKIM.
- Select Add selector and add every existing DKIM record. Enter a friendly name, choose TXT or CNAME, enter only the selector label, and paste the value supplied by your email provider.
- Confirm that every selector currently used to sign email is listed in Suped.
- Select Connect DNS and add the record shown in the dialog to your DNS provider:
- Host / name:
_domainkey.yourdomain.com - Type:
NS - Value: Use the generated Suped hostname shown in the dialog. Do not copy a value from another domain.
- Host / name:
- Remove any other NS records at the same
_domainkeyhost. Suped expects the generated hostname to be the only NS target for this delegation. - Return to Suped and select Check NS record.
TXT and CNAME selectors
| Type | Use it for | Value |
|---|---|---|
| TXT | A DKIM public key published directly at your selector | The complete DKIM TXT value supplied by your provider |
| CNAME | A selector that points to a record hosted by your provider | The complete target hostname supplied by the provider |
The selector field is only the first DNS label. For google._domainkey.yourdomain.com, enter google.
Manage selectors
Open Configure DKIM to add another selector or use the row menu to edit or remove an existing one. Suped validates TXT values as DKIM records and validates CNAME targets as DNS names before publishing them. Updated records are published immediately, but cached DNS answers can remain visible for up to one hour.
Only remove a selector after the associated sending system has stopped using it. Email that is still signed with a removed selector can no longer be verified.
Rotate a key safely
- Add the new selector and public record to Suped.
- Use the DKIM checker to confirm that the new selector resolves.
- Configure the sending provider to sign with the new selector.
- Keep the old selector published while previously sent email may still be verified.
- Remove the old selector when it is no longer in use.
Verify your setup
Use Check NS record to verify the delegation. Then use the DKIM checker with each selector to confirm that receivers can find the expected record. See DKIM concepts for an explanation of selectors, signatures, and DMARC alignment.
Stop using hosted DKIM
There is no one-click disable action. To move DNS hosting elsewhere, first recreate every active selector at the destination DNS provider and confirm that the entries are saved. They remain hidden from normal public lookups while the Suped NS delegation is active. Then remove or replace the delegation and verify public resolution for every selector as DNS caches update. Removing the delegation before staging those records can make every DKIM selector unavailable at once.
What Hosted DKIM does not do
Hosted DKIM does not sign outgoing email, store private keys, discover existing selectors, or rotate keys automatically. It hosts and manages the public DNS records used to verify signatures created by your email providers.
