How do I set up DKIM with A2 Hosting and troubleshoot validation issues?
Updated on 4 Oct 2026: We added the A2 customer portal setup path and clearer checks for DKIM TXT, CNAME, and cached DNS answers.
Set up DKIM with A2 Hosting by publishing the sender's exact DKIM TXT or CNAME record in the authoritative DNS zone. A2 Hosting is now hosting.com. Depending on your account and nameservers, DNS can be managed in cPanel, the Hosting Panel, the customer portal, or an external DNS provider.
The common setup problem is the Name field. In cPanel Zone Editor, enter the full DKIM hostname, such as default._domainkey.example.com. A root TXT verification record uses the bare domain, such as example.com. If authoritative DNS shows the record but the sender still says it is missing, check both TXT and CNAME as appropriate, allow cached answers to expire, and trigger a provider rescan.
- Direct answer: Publish the record in the panel that controls your domain's authoritative DNS.
- Root TXT: Use the full domain in cPanel; use the field format shown by the customer portal or Hosting Panel.
- DKIM host: Use the exact selector hostname supplied by the sending service.
- Validation: Check each authoritative nameserver, wait for cached answers to expire, then recheck the sender.
How DKIM and verification records differ
Legacy A2 Hosting accounts commonly have cPanel DNS controls, while some hosting.com accounts use the Hosting Panel. Domains registered through A2 can also use customer portal DNS. Different forms can ask for a relative host or a fully qualified domain name. A DNS answer can display a trailing dot; that is normal DNS syntax.
Separate two record types before touching DNS. A DKIM signing record sits at a selector hostname and contains either a public key TXT value or a CNAME target. A domain verification TXT record can sit at the root of the domain and contain a short token. Putting a root verification token under a DKIM selector, or putting a DKIM key at the root, fails validation.
Root TXT verification
This is usually a short token used to prove domain ownership.
- Host: The domain root, such as example.com.
- Value: A short vendor token or ownership string.
- Panel field: Use the full domain in cPanel and the format requested by other DNS forms.
DKIM signing record
This is the record receivers use to verify a DKIM signature.
- Host: A selector under _domainkey.
- Value: A DKIM public key or a CNAME target.
- Panel field: Use the exact hostname format shown by the DNS form.
cPanel Zone Editor screen showing DKIM TXT and CNAME records in an A2 Hosting DNS zone.
Check where A2 or hosting.com manages DNS
First find the domain's assigned nameservers. Some A2 zones use ns1.a2hosting.com through ns4.a2hosting.com. Hosting.com zones can use ns1.stableserver.net through ns4.stableserver.net. A2-registered domains using dns1.name-services.com through dns4.name-services.com can be managed in the customer portal. Use the nameservers actually delegated for your domain to choose the DNS editor; the account's age alone does not establish the correct panel.
Find and query the authoritative nameserversbash
dig NS example.com +short # Repeat with each returned nameserver: dig @authoritative-nameserver.example default._domainkey.example.com TXT +short dig @authoritative-nameserver.example default._domainkey.example.com CNAME +short
If all assigned authoritative nameservers show the expected TXT record or CNAME target, the record has been published. If one differs, check which DNS zone that server answers for before editing the record again.
Do not publish the same guess everywhere
Adding DKIM records at both the registrar and the hosting account does not help when only one platform supplies authoritative DNS. One dashboard can show the record while public DNS answers from a different provider.
Set up the DKIM record in A2 Hosting
Use the path that matches your account. In cPanel, open Zone Editor, choose Manage for the domain, and add the sender's TXT or CNAME record. For A2 or hosting.com local mail, open Email Deliverability, choose Manage, and use Repair if cPanel reports a missing DKIM record. If DNS is external, copy cPanel's suggested DKIM name and value into the authoritative zone. In a Hosting Panel account, open Websites, select the site, choose Domains, and manage the domain. Email authentication enables DKIM for hosted mail; DNS records is where you add records supplied by another sender.
- Open the correct panel: Use cPanel Zone Editor or the Hosting Panel according to the account and assigned nameservers.
- Pick the domain: Select the domain used in the visible From address.
- Add the host: In cPanel, enter the full selector hostname, such as default._domainkey.example.com.
- Add the value: Paste the TXT data or CNAME target exactly as supplied, without adding quotation marks.
- Save the record: Confirm it appears on every assigned authoritative nameserver.
- Recheck the sender: Use the sender's verify button after DNS answers correctly.
Typical DKIM TXT entry in cPaneltext
Name: default._domainkey.example.com Type: TXT TTL: 14400 Record: v=DKIM1; k=rsa; p=MIIB...IDAQAB
Typical root TXT verification entry in cPaneltext
Name: example.com Type: TXT TTL: 14400 Record: vendor-verification-token
cPanel or a DNS lookup can display a long TXT record as multiple quoted chunks. That is valid when the chunks belong to one TXT answer. DKIM validators join the chunks into one continuous value.
Add DKIM when the A2 customer portal hosts DNS
If the domain uses dns1.name-services.com through dns4.name-services.com and the customer portal manages its DNS, sign in to the A2 or hosting.com client area. Open Domains, then My Domains, select the domain, and choose DNS Management under Manage. Do not add the record only in cPanel when these nameservers answer for the domain.
- For a root ownership TXT token, use @ as Host Name when the portal labels it as the domain root.
- For DKIM, use the sender's selector under _domainkey. Check whether the portal appends your domain before entering a full hostname.
- Choose the sender's required TXT or CNAME type, paste its value exactly, save, and query the resulting full hostname on an assigned nameserver.
A record saved under default._domainkey.example.com.example.com has the domain suffix twice. Edit the Host Name field if the authoritative lookup shows that doubled name.
Validate DKIM without chasing stale answers
After saving the record, validate authoritative DNS, then public recursive DNS, then the sender platform. Query the record type the sender supplied. A CNAME at the selector should resolve to the sender's target; a TXT key should return the public key.
Query a DKIM TXT key or CNAME selectorbash
# Use one assigned nameserver, then repeat with the others dig @authoritative-nameserver.example default._domainkey.example.com TXT +short dig @authoritative-nameserver.example default._domainkey.example.com CNAME +short # Compare public recursive answers dig default._domainkey.example.com TXT +short dig default._domainkey.example.com CNAME +short
For a parsed check, use Suped's DKIM checker once the authoritative answer is visible. For a broader check across SPF, DKIM, and DMARC, run the domain health checker after the individual DKIM record checks out.
DKIM checker
Check selector records and public key configuration.
?/7tests passed
A platform validation button can lag behind DNS. Recursive resolvers can retain an old record until its prior TTL expires; a cached missing answer also has a negative-cache lifetime. Once all authoritative nameservers answer correctly, wait for cached answers to expire and trigger a fresh sender check.
The trailing dot is normal
DNS uses fully qualified names with a final dot, such as example.com.. A panel or dig can show that dot even if you did not type it. Do not remove a working record because a DNS answer shows the final dot.
Why A2 DKIM validation still fails
When DKIM is visible in DNS but validation still fails, match the exact symptom to the DNS record or message header. A DNS lookup only tests publication. It cannot show whether the active mail system signs outgoing messages.
|
|
|
|---|---|---|
No record found | Wrong DNS host | Check assigned NS records |
Selector missing | Wrong Name value | Use the full selector host |
Invalid key | Value was altered | Paste the exact value |
CNAME lookup fails | Wrong target or conflicting record at the host | Check target and remove conflicts |
Still unverified | Cached prior answer | Wait for cache expiry and recheck |
dkim=none | Sender did not sign the message | Enable signing at the sender |
Body hash failed | Message changed after signing | Check gateways and footer changes |
DKIM passes, DMARC fails | Signing domain is not aligned | Use an aligned signing domain |
Common A2 Hosting DKIM validation failures
The @ symbol is a zone-file shortcut for the zone apex, but web DNS forms handle it differently. Current cPanel guidance for the Name field uses a fully qualified domain name. Follow the format displayed by the panel instead of assuming every interface expands @ the same way.
For a cPanel-specific record-name problem, use the cPanel DKIM failure checklist. If the record is accurate but the platform still fails validation, the guide to accurate DKIM records covers stale resolver answers and provider-side checks.
Flowchart for checking A2 Hosting DKIM DNS, waiting for TTL, and rechecking the sender.
Test a real message after DNS validates
Send a new message through the exact website, mailbox, or sending platform you are testing. In the received message source, find DKIM-Signature and Authentication-Results. The DKIM-Signature header identifies the signing domain in d= and the selector in s=. Those values determine the DNS name a receiver checks.
Header fields to comparetext
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=default; ... Authentication-Results: receiver.example; dkim=pass header.d=example.com header.s=default; dmarc=pass header.from=example.com
- If DKIM is none: The message was not signed, so enable DKIM in the sending system rather than editing a visible DNS key.
- If no key is found: Query the hostname formed by s=, ._domainkey., and d=, such as default._domainkey.example.com.
- If the body hash fails: Check whether a gateway, mailing list, footer tool, or forwarding path changed signed content after signing.
- If DKIM passes but DMARC fails: Compare the d= signing domain with the visible From domain. An aligned SPF pass can also satisfy DMARC.
Use the receiver's result
Copying a message into another editor can alter whitespace or line endings and create a false body-hash failure. Prefer the Authentication-Results header added by the receiving mail system and inspect the untouched raw source.
Handle Google, iContact, and A2 records together
A domain can have more than one DKIM selector. Google can use one selector, iContact can use another, and A2 or hosting.com can publish a default selector for local mailbox sending. DKIM selectors let multiple senders sign mail for the same domain without sharing one private key.
Multiple DKIM selectors can coexisttext
default._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..." google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..." icontact._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..."
Do not replace one sender's selector with another sender's value. If Google validates and iContact does not, focus on the iContact host and value. If the hosting panel shows a default DKIM key, leave it in place while the hosting mail server still sends domain mail.
Keep selectors separate
- Google: Use the selector and TXT value generated in the Google admin flow.
- External sender: Use the exact CNAME or TXT records supplied by that sending platform.
- Hosted mail: Keep the default DKIM record while A2 or hosting.com sends domain mail.
- DMARC: Confirm the signing domain is aligned with the visible sender domain.
Use Suped after the DNS record validates
Once the record validates, check that real email is signed consistently. A DNS lookup proves the public key exists. It does not prove every production message is signed by the expected sender, uses an aligned domain, or passes DMARC.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
Suped's DMARC reporting product tracks results after the A2 or hosting.com DNS change. Review its sending-source data to identify mail streams that still fail DKIM or DMARC, then correct the source's signing configuration.
The DMARC monitoring workflow catches cases where DNS is correct but a website plugin, external sender, or mailbox system still sends unsigned or unaligned mail.
When to recheck after DNS changes
Use the record's TTL and the authoritative answer to time validation checks.
Immediate
0 min
Query every assigned authoritative nameserver after saving.
Cached answer
Up to cache TTL
Resolvers can retain prior positive or negative answers until their cache TTL expires.
Escalate
24 hr
Open a ticket if an assigned authoritative answer remains wrong after a day.
Views from the trenches
Best practices
Check authoritative DNS before editing records again or reopening the sender setup flow.
Use the full hostname in cPanel and follow the exact field format in newer account panels.
Keep each sender on its own DKIM selector so one fix does not break another sender.
Common pitfalls
Publishing records at the registrar fails when hosting nameservers answer for the domain.
Treating the trailing DNS dot as an error creates unnecessary DNS record changes.
Refreshing a sender too early can show stale failures after the DNS record is correct.
Expert tips
Query an assigned nameserver directly, then compare that answer with recursive DNS output.
Wait through the prior TTL before assuming a correct DKIM record has failed validation.
Read a received message header to confirm the selector, signing domain, and DKIM result.
Marketer view
Marketer from Email Geeks says the public DNS answer should be checked directly because it often proves the record is already present before the sender dashboard updates.
2023-11-09 - Email Geeks
Marketer view
Marketer from Email Geeks says the trailing dot shown in DNS output is normal fully qualified name syntax and should not be treated as a typo.
2023-11-09 - Email Geeks
Final DKIM validation steps
Confirm which nameservers are authoritative, open the matching DNS panel, publish the sender's exact DKIM record, and validate the selector against each assigned authoritative nameserver before trusting the sender's status screen.
If the authoritative answers are correct, wait for cached answers to expire and trigger verification again. Then send a real message and inspect DKIM-Signature and Authentication-Results. Keep DMARC reporting active so DKIM failures appear when senders change, keys rotate, or new subdomains start sending without the required DNS records.
Frequently asked questions
In cPanel Zone Editor, use the fully qualified domain name. For a DKIM record, that means a host such as default._domainkey.example.com. In customer portal DNS Management, @ denotes the root. For a selector, follow the field's hostname format and check the resulting DNS name.
No. A trailing dot is normal fully qualified DNS syntax. It appears in command output and some DNS panels when the record is correct.
Check every assigned authoritative nameserver immediately. If each shows the new record, allow cached positive or negative answers to expire, then trigger the sender's verification again. A TTL of 14400 seconds equals four hours for a previously cached positive answer.
Yes. Each sender should use its own selector. Do not overwrite one sender's DKIM record with another sender's value.
The sending system did not add a DKIM signature. Enable DKIM at that sender and send a new test message. Changing a correctly published DNS key will not make an unsigned message pass.
Compare the DKIM signing domain in the message header with the visible From domain. DKIM can pass cryptographic verification while failing DMARC alignment. Correct the sender's signing domain or confirm whether aligned SPF supplies the DMARC pass.
