Deliverability runbook · Intermediate · 15 minutes
How to set up DKIM signing — DKIM: Selectors, Key Length and the Body Hash
The panel says signing is on, and Gmail still reports dkim=neutral because the public key never actually reached DNS.
The short answer
DKIM adds a cryptographic signature over the message body and a named list of headers, and the receiver verifies it by fetching a public key from selector._domainkey.yourdomain — so the record resolving in DNS, not the panel's tick, is what makes signing real.
The result you are looking for is dkim=pass in the Authentication-Results header of a delivered message, with the d= tag naming your own domain. Every other outcome — key not found, body hash mismatch, neutral, or a pass for somebody else's domain — points at one specific cause, and each is separated out below.
By the HostingFast team · Reviewed 24 August 2026
Intermediate
Difficulty grade
5
Stages
Free
Support cost
Proven
Verified on
Written for somebody who can open a DNS zone and read raw headers. It explains what the signature covers before it explains where to click, because the failures worth knowing about are all failures of the mechanism rather than of the interface.
Where DNS is hosted with us the selector record is published automatically; where it is not, the manual path is spelled out. Nothing here is a one-way door — a key you regret is replaced by publishing a new selector alongside it.
What the signature actually covers
A signing server hashes the message body, hashes a named list of headers — From:, Subject, Date and whatever else the configuration lists — then signs the pair with a private key. The DKIM-Signature header it adds carries the selector as s=, your domain as d=, the header list as h= and both hashes.
The receiver reads s= and d=, fetches the public key from that selector's TXT record, and recomputes. That is exactly why a signature survives a forwarder when SPF does not: nothing about the connecting IP forms part of the calculation.
Getting the key into DNS, and proving it is there
cPanel's Email Deliverability page generates the key pair and prints the record required. With DNS hosted here it publishes that record itself; with DNS elsewhere the value has to be pasted into the other provider, and it is long enough that a truncated paste is a real and frequent outcome.
Confirm the record resolves before you declare the job finished. A dig TXT default._domainkey.yourdomain that comes back empty is the single most common reason mail leaves signed and arrives unverified.
Telling the failure modes apart
dkim=neutral or key not found means DNS: the selector record is missing, truncated, or being answered by a provider you stopped using. dkim=fail with a body hash mismatch means something altered the message in transit, which in practice usually means a mailing list appending a footer.
A dkim=pass whose d= names your sending platform rather than your domain is not an error at all, but it will never satisfy DMARC alignment. That case is fixed in the platform's own custom-domain settings, where it signs with a selector delegated to you.
Key length, rotation, and what to leave alone
2048-bit keys are the default here and fit in a single TXT string on our DNS; 1024-bit remains valid and is the fallback on a provider that cannot store the longer value. Both verify correctly, and neither is the reason your mail is being filtered.
Rotation is not a calendar task. Replace a key when it is compromised or when you leave a provider, and publish the new selector before switching signing across, so both keys resolve through the overlap and no message in flight fails.
The platform these checks were run against
Every screen named here is a screen in your own account — cPanel, Email Deliverability, the same defaults — so the instructions match what you see rather than gesturing at it from a distance.
Mailboxes on your own domain are part of the plan, with IMAP, POP and SMTP included; email is never sold back to you at the checkout.
- Every check ends in header output
- DNS verified with dig, not faith
- Failure modes separated by symptom
- Engineers on shift at any hour
Why HostingFast
Standard on every plan
Signature mechanics, spelled out
What the h= list covers and why the body hash matters, because those two things determine every failure you will see.
One query settles it
Whether the selector record resolves is a single dig, and the guide gives you the query rather than describing it.
Three failures, three fixes
Key not found, body hash mismatch and an unaligned d= look identical from a spam folder and have nothing in common underneath.
Key length in plain figures
2048-bit by default, 1024-bit where a DNS provider cannot hold the longer value, and why neither is your deliverability problem.
Panel work already done
With DNS here, the selector record is published for you the moment signing is switched on.
Engineers who read raw headers
Paste the DKIM-Signature line at any hour and get an answer about that line, not a link to an article.
Quick Start
From order to online
- 1
Generate the key pair in the panel
Email Deliverability, then Install on the domain. cPanel creates the private key on the server and prints the public half as a TXT record — on our hosting that is usually a single button.
- 2
Publish the selector record, then resolve it
The public key belongs at selector._domainkey.yourdomain. Confirm with dig TXT before you send a test, because a record that does not answer is indistinguishable from no DKIM at all.
- 3
Add a selector for every other sending platform
Newsletter tools and CRMs sign with their own keys and hand you a CNAME or TXT per selector. Selectors coexist without conflict; the target is every stream that sends as you carrying a verifiable signature.
- 4
Read dkim= from a delivered message
Send to an external mailbox, open the original, and check Authentication-Results. You want dkim=pass with d= naming your own domain rather than the sending platform's.
- 5
Leave the keys alone until there is a reason
Rotate on compromise or a provider change, publishing the new selector first. Rotation on a schedule with no overlap simply breaks alignment for no measurable gain.
Built In
Loaded onto every plan
- Mailboxes on your own domain, included with the plan
- IMAP, POP, SMTP and browser webmail on every mailbox
- Spam and virus screening on every mailbox as standard
- cPanel — the panel most of the industry already automates against
- NVMe SSD storage on every tier, not just the expensive ones
- LiteSpeed caching in the server itself, not bolted on by plugin
- SSH, Git and Composer on the developer-focused plans
- Staging environments for testing before anything ships
- Engineers on shift every hour of every day, not a queue that opens at nine
- Migration handled by our engineers at no charge
Frequently Asked
What people ask us most often
Why does Gmail report dkim=neutral when the panel says signing is switched on?
Because signing and publishing are two separate things. The server is signing, but the selector record either was never added to the zone that answers for your domain, or was truncated on paste. Run dig TXT against the selector; if it returns nothing, that is the whole fault.
Does a mailing list break my DKIM signature?
Often, yes. Appending a footer changes the body, so the body hash no longer matches and verification fails even though the key is fine. Relaxed body canonicalisation absorbs whitespace changes but not added text, and the l= length tag that would tolerate it opens a message to tampering — so lists are better solved with ARC at the receiving end than with a weaker signature at yours.
Do mailboxes ship with the plan, or are they billed separately?
Yes — every hosting plan includes mailboxes on your own domain, with webmail, IMAP, POP and SMTP plus spam filtering switched on from the start. There is also standalone email hosting for a domain whose website lives somewhere else entirely.
Where does the hardware sit, and how much does location cost me?
Our platform runs from a London datacentre with redundant power, cooling and multiple upstream carriers, fronted by server-level caching that keeps cached pages fast for visitors worldwide. For most sites, how the platform is engineered — NVMe disks, LiteSpeed, restrained account density per machine — matters far more to speed than the location does.
Keep reading
How to Set Up Browser Caching
Cache-Control and ETag headers set so a repeat visit costs almost no bytes.
How to Install WordPress
A WordPress install answering on your domain, with the first-request numbers worth recording.
DKIM (DomainKeys Identified Mail) (Glossary)
The signing mechanism defined in one screen, including what the selector is for.
Domain Names
Register or move a name — the first year is included with an annual plan.
WordPress Hosting
WordPress on LiteSpeed with staging and daily backups already wired in.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Sign it, ship it, measure it.
Every plan carries the pieces other hosts bill as extras — SSL, migration, backups, mailboxes — plus engineers who answer.
View Domain Names plans