How to add DKIM CNAME records to send email from your custom domain
When you add a sending domain in QRS, Amazon SES automatically generates DKIM tokens to verify domain ownership. You need to add DKIM CNAME records to your DNS to complete the setup. Once verified, emails sent from the system will be DKIM-signed, improving deliverability and avoiding spam filters.
What are DKIM CNAME records?
DKIM (DomainKeys Identified Mail) is an email authentication method that proves emails were actually sent from your domain. Amazon SES uses Easy DKIM, generating 3 token pairs. Each token requires a CNAME record in your DNS.
Step-by-step guide
Add a sending domain in the CMS
Go to "Domains" in the CMS and add the domain you want to use for sending emails (e.g., mail.example.com or example.com). The system will automatically generate 3 DKIM tokens and display the CNAME records you need to add.
Log in to your DNS management panel
Go to your domain registrar's DNS management page (Cloudflare, GoDaddy, Namecheap, etc.). Look for DNS records management or Zone Editor.
Add the 3 DKIM CNAME records
For each token displayed in the CMS, create a CNAME record using the following template. Replace {token} with the actual token value from the CMS and {domain} with your domain.
Reference table for the 3 DKIM CNAME records
| Field | Value | Notes |
|---|---|---|
| Type | CNAME | All 3 records are CNAME |
| Name (Record 1) | {token1}._domainkey.{domain} | Replace {token1} and {domain} with actual values |
| Value (Record 1) | {token1}.dkim.amazonses.com | Target value from the CMS |
| Name (Record 2) | {token2}._domainkey.{domain} | Replace {token2} and {domain} with actual values |
| Value (Record 2) | {token2}.dkim.amazonses.com | Target value from the CMS |
| Name (Record 3) | {token3}._domainkey.{domain} | Replace {token3} and {domain} with actual values |
| Value (Record 3) | {token3}.dkim.amazonses.com | Target value from the CMS |
| TTL | 3600 (or Auto) | Default value is acceptable |
Example DKIM CNAME records (replace tokens and example.com with actual values)
; DKIM CNAME records — replace {token} and example.com with your values
{token1}._domainkey.example.com. IN CNAME {token1}.dkim.amazonses.com.
{token2}._domainkey.example.com. IN CNAME {token2}.dkim.amazonses.com.
{token3}._domainkey.example.com. IN CNAME {token3}.dkim.amazonses.com.Get token values from the CMS
You don't need to calculate record names yourself. The CMS displays the exact Name and Value for each record. Simply copy and paste them into your DNS management page.
Verify the domain in CMS
After adding the 3 CNAME records, go back to the CMS and click the verify button. The system will verify the DKIM records with Amazon SES.
Wait for verification to complete
DKIM verification typically takes 5-30 minutes for DNS propagation and Amazon SES confirmation. In some cases it can take up to 72 hours.
Troubleshooting
| Issue | Cause | Solution |
|---|---|---|
| DKIM verification failed | DNS records not yet propagated or incorrect values | Double-check the CNAME record names and values. Wait 10-15 minutes for DNS propagation then retry. |
| Emails land in spam | DKIM not verified or incomplete | Ensure all 3 CNAME records are added correctly and DKIM status shows Success. |
| CNAME record not recognized | Record name format is incorrect | Some DNS providers require the record name without the root domain. E.g. enter only "abc123._domainkey" instead of "abc123._domainkey.example.com". |
| DKIM status is TEMPORARY_FAILURE | Temporary error from Amazon SES | Retry after 10-15 minutes. If it persists, click regenerate DKIM tokens in the CMS. |
| Using Cloudflare with proxy enabled | Proxy does not support DKIM CNAME records | Disable proxy (set to DNS only / grey cloud) for the DKIM CNAME records. |
Commands to verify DKIM CNAME records
# Check DKIM CNAME records on macOS/Linux
dig {token}._domainkey.example.com CNAME
# Check on Windows
nslookup -type=CNAME {token}._domainkey.example.com
# Check all DKIM records at once
dig +short {token1}._domainkey.example.com CNAME
dig +short {token2}._domainkey.example.com CNAME
dig +short {token3}._domainkey.example.com CNAMENeed more help?
If you encounter an issue not listed above, contact our support team via the Contact page or email support@qrs.com.vn.
Was this article helpful?