Enable and Configure DKIM in Plesk

Enable automatic DKIM signing for your emails in Plesk. Learn how to configure DKIM server-wide, enable it for domains, and manage external DNS setups.

Last updated: July 2026

In short: DKIM email signing is enabled in Plesk by default. Administrators can manage permissions server-wide, while users can toggle DKIM at the domain level. If your domain uses an external DNS service, you must copy the generated DKIM records and add them manually to your DNS zone.

If you send emails from a Plesk Obsidian server and security tools like Kuveris flag a missing DKIM signature, you can easily configure signing directly in the control panel. Plesk automates key generation and DNS record management.

Default Behavior and Server-Wide Settings

In a standard Plesk installation, DKIM signing is active out of the box: DKIM is enabled in Plesk by default.

Administrators can control server-wide DKIM settings by navigating to the mail configuration: go to Tools & Settings > Mail Server Settings (under “Mail”), scroll down to the “DKIM spam protection” section, and clear one of the following checkboxes or both of them:

One of these options controls user access: “Allow signing outgoing mail”. This option enables customers to manage the DKIM signing of outgoing mail on a per-domain basis.

When this is enabled, subscribers and domain administrators can toggle DKIM for their own domains.

Enabling DKIM for a Domain

To enable DKIM for an individual domain, navigate to the domain's mail settings in the customer panel:

Go to Websites & Domains > your domain > the “Mail” tab > Mail Settings. Select the “Use DKIM spam protection system to sign outgoing email messages” checkbox and then click Apply

Once you apply the change, Plesk generates the required cryptographic keys.

DNS Zone Updates: Local vs. External DNS

How the public key is published depends on where your domain's DNS is hosted.

If your domain's DNS is hosted locally on the Plesk server, Plesk handles everything: new domains that have their DNS and mail hosting in Plesk sign outgoing mail with DKIM by default. Domains that use an external DNS server cannot have DKIM enabled by default.

When DKIM is enabled, the DNS records are updated automatically: Plesk adds the following two records to the DNS zone of the domain

This includes the TXT record published under default._domainkey.

Manual DNS Configuration for External Nameservers

If you host your domain's DNS zone on an external provider (such as Cloudflare, Route 53, IONOS, or Hetzner), Plesk cannot directly update your DNS records: Unlike domains hosted in Plesk, Plesk cannot add these records to domains that use an external DNS server. For those domains, you need to enable DKIM manually.

In this scenario:

  1. Enable DKIM in the domain's Mail Settings panel in Plesk to generate the key.
  2. Click the "How to configure external DNS" hint to reveal the two generated records.
  3. Copy the values and manually add the TXT records (especially the default._domainkey record) to your external DNS provider's interface.

Verifying Your Setup

Once DKIM is enabled and the DNS record is active, send a test email. Use the free Kuveris scanner to ensure that the DKIM signature is correctly attached to your outgoing mail and aligns with your DNS record.

Further reading