DKIM for Postmark: Domain Authentication Setup Guide

This guide is part of our Transactional and API series.

Postmark is built for transactional email, and it takes deliverability seriously. But even with Postmark's strong sending reputation, your emails still need proper authentication to reach inboxes reliably. DKIM is a key part of that authentication. Without it, receiving servers have no way to verify that emails claiming to come from your domain were actually authorized by you.

Setting up DKIM in Postmark is straightforward. Postmark generates the DKIM key for you and provides a DNS record to add to your domain. Once verified, every email Postmark sends on your behalf gets signed automatically. This guide walks you through the full process.

Why DKIM Matters for Postmark

Postmark already has a strong sender reputation, but DKIM adds a layer of trust that's tied directly to your domain. When a receiving server sees a DKIM signature on your transactional email, it can verify that the message hasn't been tampered with and that you authorized Postmark to send on your behalf.

Without DKIM, your transactional emails - password resets, order confirmations, account notifications - are more likely to be delayed, filtered, or flagged as suspicious. For business-critical messages, that's a problem you want to avoid.

DKIM also plays an important role in DMARC alignment. If you have a DMARC policy (and you should), DKIM helps your Postmark emails pass alignment checks so they're covered by your domain's authentication policy.

How Postmark Handles DKIM

Postmark manages DKIM through its Sender Signatures feature. When you add a domain as a sender signature, Postmark generates a DKIM key pair behind the scenes. You receive a TXT record containing the public key, which you add to your DNS. Postmark keeps the private key and uses it to sign every outgoing email from that domain.

Postmark uses a date-based selector format: YYYYMMDD.pm._domainkey. For example, you might see a selector like 20260618.pm._domainkey. This format makes it easy to identify when a key was created and distinguishes Postmark's records from those of other email services.

One helpful feature is that Postmark handles key rotation automatically. Periodically, Postmark generates new DKIM keys and prompts you to update the DNS record. This keeps your authentication current without you having to track rotation schedules yourself.

Setting Up DKIM in Postmark

Postmark DKIM DNS Record Format

Here's what the DNS record looks like when you add it to your domain:

Key Rotation in Postmark

One of the advantages of using Postmark is automatic DKIM key rotation. Postmark periodically generates new DKIM keys to maintain strong security. When a new key is ready, Postmark notifies you and provides an updated DNS record.

When you receive a key rotation notification:

1. Log in to Postmark and go to Sender Signatures
2. Find the domain with the pending key rotation
3. Copy the new DKIM TXT record
4. Update the TXT record in your DNS with the new values
5. Verify the new record in Postmark

Keep the old DNS record in place until the new one is verified. This ensures there's no gap in authentication during the transition. Once Postmark confirms the new key is active, you can safely remove the old record.

Using Postmark with Other Email Services

Many businesses use Postmark for transactional email alongside another service for marketing email (like Mailchimp or HubSpot). Since each service uses its own DKIM selector, there's no conflict. Postmark's YYYYMMDD.pm selector won't interfere with selectors from other providers.

You can have multiple DKIM records on the same domain - one for each email service. Each service signs emails with its own key, and receiving servers check the correct record based on the selector specified in the email header.

Troubleshooting Postmark DKIM

Verification fails in Postmark

• Confirm the TXT record hostname matches exactly what Postmark shows - watch for DNS providers that auto-append your domain name
• Check that the full public key value was copied without truncation (it's a long string)
• Wait at least 30 minutes for DNS propagation before retrying

DKIM passing but return-path not verified

• Postmark requires both records. Make sure the return-path CNAME record is also in your DNS
• The return-path record is a CNAME, not a TXT record - double-check the record type

Emails still landing in spam

• Verify that DMARC is configured for your domain alongside DKIM
• Check that your From address matches the authenticated domain
• Review your sending patterns - even with authentication, sending practices affect deliverability

Key rotation notification received

• Don't ignore it. Update your DNS record with the new values from Postmark
• The old key continues working until you complete the rotation, but delaying increases security risk
• After updating DNS, return to Postmark to verify the new record

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• Postmark official documentation — DKIM setup

---

Using Postmark for transactional email? Make sure your domain authentication is complete so every message reaches the inbox.