Migrating to OnDMARC's Dynamic Services: DKIM

This guide explains how to add and migrate your existing DKIM selectors to OnDMARC’s Dynamic DKIM before delegating the protocol. Following this process ensures that your signed emails continue to pass authentication without interruption during the transition.

Overview of Dynamic DKIM

Dynamic DKIM allows you to manage all of your domain’s DKIM keys and selectors from a single interface. By delegating the _domainkey.mydomain.com subdomain to OnDMARC, you can add, rotate, or remove keys instantly without having to modify your DNS zone file for every change.

Step 1: Migrate Existing Selectors to OnDMARC

Before delegating the protocol in your DNS, it is recommended to manually "prime" the Dynamic DKIM panel with your current active keys.

1. If it is not already enabled, log in to your OnDMARC dashboard and go to the DMARC > Dynamic Services > Select CONFIGURE DYNAMIC SERVICES to toggle the feature and enable it in the backend.

2. Select the DKIM tab.

3. Find the selectors in your DNS zone (for example, in google._domainkey, the selector is google).

4. In the Dynamic DKIM panel, enter the following details for each existing key by clicking on the ADD NEW SELECTOR button and populating the following columns:

For Example:

• Selector: Enter the selector name before the ._domainkey record (e.g., GOOGLE).

• Type: Select TXT or CNAME depending on the record type

• Value: Paste your existing public key string.

  Sample TXT Value: v=DKIM1; k=rsa; p=<EXAMPLE PUBLIC KEY STRING HERE>...

4. Click ADD DKIM ENTRY.

5. Verify: Ensure the key appears in the Managed Selectors section of the Dynamic Services tab and is marked as a valid DKIM key.

Step 2: Delegate DKIM (DomainKeys Identified Mail)

Once all of the necessary selectors have been added to Dynamic Services, you can safely delegate the _domainkey subdomain to OnDMARC. This is a proactive step for active sending domains, though typically optional for inactive or "parked" domains.

1. In OnDMARC, navigate to DMARC > Dynamic Services > DKIM tab.

2. Prepare to copy the NS record generated name and value (e.g.,_domainkey.mydomain.com and ns-dkim.ondmarc.com) as shown in the screenshot below:

3. Go to your DNS Provider (e.g., Cloudflare, GoDaddy):

   • Type: NS

   • Name: _domainkey or (full version _domainkey.mydomain.com)

   • Value: Paste the smart server address provided by OnDMARC (e.g., ns-dkim.ondmarc.com).

4. Save the record.

5. Remove any existing (_domainkey.) DKIM records from your DNS zone.

Important Deployment Notes

• Subdomain Delegation: By publishing this record, you are specifically delegating the _domainkey subdomain portion of your DNS to OnDMARC’s smart servers. You are not delegating your entire root domain.

• Zero Downtime: Because you added the keys in Step 1 before changing the DNS records, receiving servers will still find your keys at the new delegated location immediately, preventing authentication failures.

• Ongoing Management: From this point forward, any new DKIM keys should be added directly into the OnDMARC Dynamic DKIM panel rather than your DNS provider.