Can You Have Multiple DKIM Records? Yes, Here's How

A common question when setting up email authentication: Can you have multiple DKIM records for the same domain? The answer is yes—and most organizations need exactly that.

Why You Need Multiple DKIM Records

Most businesses send email through multiple services:

• Employee email: Google Workspace or Microsoft 365
• Marketing campaigns: Mailchimp, Klaviyo, or HubSpot
• Transactional email: SendGrid, Postmark, or Amazon SES
• CRM emails: Salesforce or HubSpot
• Support tickets: Zendesk or Freshdesk

Each of these services needs its own DKIM key to sign emails on your behalf. Without separate keys, you'd have to share your private key across services—a major security risk.

How Multiple DKIM Records Work

The secret is selectors. Each DKIM record has a unique selector that identifies which key to use.

When an email is signed, the selector is included in the DKIM-Signature header:

DKIM-Signature: ... s=google; d=example.com; ...

The receiving server sees s=google and looks up:

google._domainkey.example.com

Different services use different selectors, so their DNS records don't overlap.

Example: Multiple Services, Multiple Selectors

Here's what a typical multi-service setup looks like in DNS:

| Service | Selector | DNS Record | |---------|----------|------------| | Google Workspace | google | google._domainkey.example.com | | Mailchimp | k1 | k1._domainkey.example.com | | SendGrid | s1 | s1._domainkey.example.com | | HubSpot | hs1 | hs1._domainkey.example.com |

Each record contains a different public key corresponding to that service's private key.

Setting Up Multiple DKIM Records

Common Selectors by Service

Here are the default selectors used by popular services:

What About Multiple Records with the Same Selector?

You cannot have multiple DKIM records with the same selector. Each selector must be unique within your domain.

If two services somehow used the same selector (rare), you'd have a conflict. In practice, this almost never happens because each service chooses a unique selector for their keys.

Key Rotation and Multiple Records

Some services use multiple selectors for key rotation:

• Google Workspace: google and google2
• Microsoft 365: selector1 and selector2

During rotation:

1. The service generates a new key with the alternate selector
2. They start signing with the new key
3. The old key remains valid briefly for in-flight emails
4. Eventually, all emails use the new key

You should have DNS records for both selectors so rotation works seamlessly.

Managing Multiple DKIM Records

With multiple services, DKIM management can get complex. Here's how to stay organized:

Keep a DKIM Inventory

Create a spreadsheet tracking:

• Service name
• Selector
• When it was added
• When you last verified it
• Any notes (e.g., "Marketing team manages this")

Regular Audits

Periodically check all your DKIM records:

• Are all selectors still resolving?
• Are any services no longer in use (remove their records)?
• Are any new services missing DKIM setup?

Document for Your Team

Ensure your team knows:

• Which services send email for your domain
• Who's responsible for each service's configuration
• How to verify DKIM is working

Troubleshooting Multiple Records

"DKIM not found" for one service

Cause: That specific selector's record is missing or misconfigured.

Solution: Check DNS for that exact selector. Other services working doesn't mean all are configured.

All services except one pass DKIM

Cause: One service has an incorrect record or signing isn't enabled.

Solution:

• Verify the DNS record for that service's selector
• Check that DKIM signing is enabled in that service's settings
• Test by sending an email and checking headers

Conflicting advice about "the" DKIM record

Context: Some guides talk about "your DKIM record" as if there's only one.

Reality: Modern email setups typically have multiple DKIM records. Each guide usually refers to the record for that specific service.

Impact on DMARC

DMARC checks whether DKIM (or SPF) passes and aligns with your From domain. With multiple DKIM records:

• Only one DKIM signature needs to pass and align for DMARC to pass
• It doesn't matter which service signed the email
• All your services contribute to DMARC compliance

This is actually an advantage—if one signature fails (perhaps due to email modification in transit), another service's signature might still pass.

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.