How to Configure and Check Postmark DKIM Records

Setting up email authentication correctly is essential for delivery, and getting your postmark dkim record setup right ensures your outbound messages avoid the spam folder. DomainKeys Identified Mail (DKIM) adds a cryptographic signature to your emails, proving to receiving mail servers that the message actually originated from your domain and was not altered in transit. Without this configuration, mail providers like Gmail and Microsoft may reject your emails or flag them as suspicious.

To quickly verify your progress as you work through this guide, you can use the DKIM Checker to instantly query your domain's DNS records and confirm that your public key is published and formatted correctly.

Understanding Postmark DKIM Architecture

When you send emails through Postmark, you must authorize them to sign messages on behalf of your domain. Postmark uses three specific canonical domain records for a complete setup: a Return-Path (envelope sender) record and two DKIM CNAME records. The DKIM records use unique selector names generated by Postmark to ensure secure key rotation and distinct namespace management.

Unlike traditional providers that might ask you to publish long string values directly into your DNS, Postmark utilizes CNAME records for DKIM. This means Postmark manages the actual public keys on their end, while your DNS simply points to their infrastructure. This approach allows Postmark to update or rotate keys seamlessly without requiring you to manually log into your DNS host every time a security update occurs.

Step-by-Step Postmark DKIM Record Setup

Configuring your DKIM records requires access to your domain's DNS management console, such as Cloudflare, Route 53, GoDaddy, or Namecheap. Note that specific menu paths and terminology will vary depending on your DNS provider, but the core DNS record types and values remain identical.

Step 1: Retrieve Your Records from Postmark

1. Log into your Postmark account dashboard.
2. Navigate to your Sender Signatures section and select the domain you want to configure.
3. Locate the DKIM and Return-Path DNS settings for that domain.
4. Keep this page open; you will need to copy the exact hostnames and target values provided.

Step 2: Add the First DKIM CNAME Record

Postmark requires two separate DKIM CNAME records for redundancy and cryptographic rotation. The selectors usually look similar to pm._domainkey and pm2._domainkey (or a custom selector string provided in your dashboard).

1. Open your DNS provider's management console and select your domain name.
2. Create a new DNS record and choose CNAME as the type.
3. In the Name, Host, or Alias field, enter the first selector provided by Postmark (for example: pm._domainkey). Do not include your root domain name if your DNS provider automatically appends it.
4. In the Target, Points to, or Value field, paste the exact destination provided by Postmark (typically ending in pm.mtasv.net).
5. Set the TTL (Time to Live) to automatic or 3600 seconds, and save the record.

Step 3: Add the Second DKIM CNAME Record

1. Create another new CNAME record in your DNS console.
2. Enter the second selector provided by Postmark (for example: pm2._domainkey).
3. Paste the corresponding target destination provided by Postmark.
4. Save the record.

Step 4: Add the Return-Path CNAME Record (Recommended)

While technically distinct from DKIM, the Return-Path record is part of your domain's core authentication suite for Postmark and works hand-in-hand with DKIM to satisfy DMARC alignment.

1. Create a new CNAME record.
2. Enter pm-bounces in the host field.
3. Paste the target value provided by Postmark (ending in pm.mtasv.net).
4. Save the record.

Exact Record Syntax and Examples

Your DNS records should follow standard CNAME formatting. Below is an example of how your Postmark DNS configuration should look in your zone file, assuming your domain is example.com:

pm._domainkey.example.com.   IN CNAME pm.mtasv.net.
pm2._domainkey.example.com.  IN CNAME pm2.mtasv.net.
pm-bounces.example.com.     IN CNAME pm.mtasv.net.

Record Type	Host / Name	Target / Value	Purpose
CNAME	pm._domainkey	pm.mtasv.net	Primary DKIM signature verification
CNAME	pm2._domainkey	pm2.mtasv.net	Secondary DKIM signature verification
CNAME	pm-bounces	pm.mtasv.net	Return-Path alignment for DMARC

How to Verify Your Postmark DKIM Setup

Once you have published your DNS records, global propagation can take anywhere from a few minutes up to 24 hours depending on your DNS host and TTL settings. You can verify your records manually using command-line tools or through the Postmark dashboard.

Using Command Line Tools

You can query your newly created CNAME records using dig or nslookup to ensure they resolve properly to Postmark's servers.

# Check the primary DKIM record using dig
dig CNAME pm._domainkey.example.com +short

# Check the secondary DKIM record using nslookup (Windows PowerShell)
Resolve-DnsName -Name pm2._domainkey.example.com -Type CNAME

A correct response will return the Postmark target destination (e.g., pm.mtasv.net.), proving that your DNS records are active and pointing to the right place.

Verifying Inside Postmark

After your DNS queries return the expected targets, return to your Postmark dashboard, go back to your domain settings, and click the Verify DNS button. Postmark will perform an automated check against global DNS resolvers. Once verified, the status indicator will turn green, and Postmark will begin signing your outbound mail.

Common Mistakes and How to Fix Them

Even experienced engineers occasionally run into roadblocks during email authentication setup. Here are the most common pitfalls and how to resolve them:

• Duplicated Domain Names in DNS Host Field: Many DNS providers automatically append your root domain to the host field. If you enter pm._domainkey.example.com instead of just pm._domainkey, your actual resulting record becomes pm._domainkey.example.com.example.com, causing lookup failure. Check your provider's preview pane before saving.
• Using TXT Instead of CNAME: Postmark specifically requires CNAME records for DKIM so they can manage the underlying cryptographic keys. Do not attempt to paste a public key string into a TXT record unless instructed by a custom legacy setup.
• Propagation Delays: If you verify immediately after saving and Postmark reports an error, wait 15 minutes and try again. Global DNS propagation is outside of Postmark's control.
• Conflicting Records: Ensure you do not have old DKIM records from a previous email provider active under the exact same selector names.

Postmark DKIM Setup Checklist

• Retrieved exact CNAME selectors and targets from the Postmark dashboard.
• Created the primary DKIM CNAME record (pm._domainkey).
• Created the secondary DKIM CNAME record (pm2._domainkey).
• Created the Return-Path CNAME record (pm-bounces).
• Verified correct host formatting without accidental domain duplication.
• Tested record resolution using command-line tools or a verification utility.
• Clicked 'Verify DNS' inside the Postmark dashboard for green status confirmation.