DKIM for Fastmail: Custom Domain Setup Guide

This guide is part of our Email Providers series.

Fastmail is a popular choice for businesses and professionals who want reliable, privacy-focused email. If you use Fastmail with your own domain, setting up DKIM is one of the best things you can do to make sure your messages land in the inbox instead of the spam folder.

The good news is that Fastmail makes DKIM setup straightforward. Unlike many email providers that ask you to generate and manage your own keys, Fastmail handles key generation and rotation for you. All you need to do is add a few DNS records and verify them.

Why DKIM Matters for Fastmail Users

When you send email from a custom domain through Fastmail, receiving servers (like Gmail, Outlook, and Yahoo) check whether your message has a valid DKIM signature. Without one, your emails are more likely to be flagged as suspicious or sent to spam.

DKIM works alongside two other email authentication standards - SPF and DMARC - to build trust with receiving mail servers. If you're new to DKIM, our complete guide explains the fundamentals. Together, they prove that your emails genuinely come from your domain and haven't been tampered with along the way.

For small businesses, this is especially important. Your invoices, proposals, and customer communications need to arrive reliably. A missing DKIM record can quietly undermine your email deliverability without you ever knowing.

How Fastmail Handles DKIM

Fastmail takes a different approach than many email providers. Instead of asking you to generate your own DKIM key pair, Fastmail creates the keys for you automatically when you add a custom domain. It then gives you three CNAME records to add to your DNS.

These CNAME records point to Fastmail-hosted keys. The advantage of this approach is that Fastmail can rotate your DKIM keys in the background without you needing to update your DNS records each time. Key rotation is an important security practice, and Fastmail handles it transparently.

Setting Up DKIM for Your Custom Domain

Common Issues and How to Fix Them

Records not verifying in Fastmail - DNS changes can take anywhere from a few minutes to 48 hours to propagate. If Fastmail can't verify your records right away, give it some time and check again later.

CNAME records not supported - Some DNS providers don't allow CNAME records on subdomains that include underscores. In this case, switch to the TXT record alternatives that Fastmail provides in the domain wizard.

Existing DKIM records from a previous provider - If you previously used a different email service, you may have old DKIM records in your DNS. These won't conflict with Fastmail's records (since they use different selectors), but you can remove them to keep things tidy.

Email still going to spam - DKIM is one part of the puzzle. Make sure you also have a valid SPF record and consider setting up a DMARC policy. Fastmail's domain wizard covers all of these.

DKIM with Fastmail vs. Other Providers

Fastmail's CNAME-based approach is one of the simplest DKIM setups you'll find. Because the actual keys live on Fastmail's servers, you never need to handle private keys or worry about key length and format. The tradeoff is that you have slightly less direct control, but for most small businesses, the convenience and automatic rotation far outweigh that.

After Setup: Confirming Everything Works

Once Fastmail verifies your DNS records, send a test email to a Gmail or Outlook address. Open the received message and check the email headers (in Gmail, click the three dots and choose "Show original"). Look for a line that says dkim=pass - that confirms your DKIM is working.

If you manage multiple domains through Fastmail, repeat this process for each one. Every domain needs its own set of three CNAME records.

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• Fastmail official documentation — Custom domain DKIM and DNS setup

---

Using Fastmail with a custom domain? Make sure your DKIM records are properly configured so every message you send is trusted.