PowerMTA DKIM Signing Setup
DKIM signing proves your email is really from you. Here's how to set it up correctly in PowerMTA and keep it secure over time.
TL;DR
Generate a key pair, publish the public key at a selector in DNS, point PowerMTA at the private key per domain, and rotate keys periodically. See the broader SPF/DKIM/DMARC guide for the full picture.
How DKIM works in PowerMTA
PowerMTA holds your private DKIM key and signs each outbound message. Receivers fetch your public key from DNS and verify the signature — confirming the message wasn't forged or altered. This is core to the delivery checks every provider runs.
Step 1 — Generate a key pair
Create an RSA key pair (2048-bit recommended). The private key stays on the server; the public key goes into DNS.
Step 2 — Publish the public key
Add a TXT record at selector._domainkey.yourdomain.com:
s1._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."The selector (e.g. s1) lets you run multiple keys and rotate cleanly.
Step 3 — Configure PowerMTA to sign
In the PowerMTA config, reference the private key and selector per domain so each sending domain signs with its own key.
Step 4 — Rotate keys periodically
Rotate DKIM keys every few months. Publish a new selector, switch signing to it, then retire the old one after mail in transit clears. Rotation limits exposure if a key leaks.
Common DKIM mistakes
- Wrong selector in the config → signatures fail.
- Public key record split/truncated in DNS.
- DKIM domain not aligned with the From domain → DMARC alignment fails.
AutoPMTA generates DKIM keys and checks signing in its DNS Health module. See pricing.
Key takeaways
- PowerMTA signs with your private key; DNS holds the public key.
- Selectors let you run and rotate multiple keys.
- Sign per domain and keep DKIM aligned with the From domain.
- Rotate keys every few months for security.
Frequently asked questions
What is a DKIM selector?+
A selector is a label in the DKIM DNS record path (e.g. s1._domainkey.yourdomain.com) that identifies which key to use. Selectors let you run multiple keys and rotate them without downtime.
How often should I rotate DKIM keys?+
Rotate DKIM keys every few months as a security best practice. Publish a new selector, switch signing to it, and retire the old key once in-transit mail has cleared.
Why is my DKIM failing in PowerMTA?+
Common causes are a wrong selector in the config, a truncated public-key DNS record, or the DKIM domain not aligning with the From domain, which breaks DMARC alignment.