Enabling DKIM in cPanel should be straightforward—click a button, wait for DNS propagation, done. In practice, you'll hit cryptic errors, missing records, or silent failures that leave your mail unauthenticated. I've walked through these issues hundreds of times in support tickets, and the same seven problems account for nearly all of them.
This guide covers each error with its symptoms, the actual cause, and the fix that works.
Error 1: "DKIM is not enabled for this domain"
You navigate to Email Deliverability in cPanel, expecting to see DKIM active, but the interface shows it's disabled. The toggle won't stick, or there's no toggle at all.
What's happening
The cPanel service responsible for email authentication (cpanel-dovecot-solr or the email authentication stack) hasn't initialized DKIM for the domain. This happens after fresh domain additions, migrations, or when the mail server configuration was rebuilt without re-enabling authentication.
The fix
Log into WHM as root. Go to Home > Email > Email Deliverability (the server-wide version, not the cPanel one). Find your domain in the list. Click Manage next to it.
If DKIM shows as "Not Installed," click Install the suggested record. WHM will generate the key pair and push the private key to the mail server configuration. Wait 30 seconds, then refresh. The status should flip to valid or show a DNS warning.
If you don't have WHM access, your host needs to enable it. cPanel users can't force DKIM installation without server-level permissions.
Error 2: "No DKIM record found" in email headers
Outbound mail leaves your server, but the receiving side logs dkim=none or dkim=neutral (no sig). The DKIM-Signature header is missing entirely.
Root cause
The private key exists, the DNS record is published, but the MTA (Exim) isn't signing messages. Two common reasons: the domain's mail routing is set to remote, or the DKIM configuration file is missing the domain entry.
How to fix it
First, check mail routing. In cPanel, go to Email Routing under the Email section. Make sure it's set to Local Mail Exchanger. Remote routing tells Exim not to handle mail for that domain, so it won't sign anything.
If routing is local, SSH into the server and check Exim's DKIM config:
grep -r "yourdomain.com" /etc/exim.conf.d/
You're looking for a reference in the DKIM transport or authenticator block. If it's missing, regenerate the configuration:
/scripts/buildeximconf
systemctl restart exim
Then send a test email and inspect the raw headers. The DKIM-Signature: line should appear near the top.
Error 3: DKIM record in DNS doesn't match the key
The Email Deliverability interface in cPanel shows a red X: "The DKIM record in DNS does not match the record on the server." Mail gets rejected by Gmail or Outlook with dkim=fail (signature verification failed).
Why this happens
Someone edited the TXT record manually—maybe shortening it, copying it wrong, or pasting an old value after a key regeneration. Or DNS was migrated to a new provider and the record didn't come over cleanly. Trailing dots, quotes, and whitespace differences all break DKIM.
The fix
Grab the correct public key from the server. In WHM, go to Email Deliverability, click Manage for the domain, and copy the full TXT record value cPanel expects. It's a long string starting with v=DKIM1; k=rsa; p=....
Now check what's actually published in DNS:
dig default._domainkey.yourdomain.com TXT +short
If the output doesn't match character-for-character, update the DNS record. If you're using cPanel's DNS editor, delete the old default._domainkey TXT record and let cPanel recreate it by clicking Reinstall in the Email Deliverability manager.
External DNS (Cloudflare, Route 53, etc.)? Paste the full key cPanel gave you into a new TXT record for default._domainkey. No extra quotes, no line breaks. Wait for propagation (usually under 5 minutes for TXT records), then verify again with dig.
Error 4: "DKIM key is too weak"
You see a warning in Email Deliverability: "The DKIM key for this domain is less than 1024 bits." Some mail servers (notably Microsoft 365) start soft-failing your signatures.
What's wrong
Older cPanel installations generated 512-bit RSA keys for DKIM. That was fine in 2015. It's not fine now. Modern standards require at least 1024 bits, and 2048 is the safe default.
Generate a stronger key
In WHM, go to Email Deliverability > Manage for the domain. Click Reinstall or Regenerate—the exact label depends on your cPanel version. In the options, set key size to 2048 bits if given a choice. WHM will create a new key pair and update the DNS suggestion.
Update your DNS with the new public key (see Error 3 for steps). The old key stops working the moment you regenerate, so do DNS first if you're managing records externally. I've seen mail queues pile up because someone regenerated the key and forgot to update DNS for two hours.
Error 5: Permission denied on DKIM private key file
Exim logs show DKIM error: transport_dkim_private_key: failed to open /var/cpanel/domain_keys/... or Permission denied. Outbound mail either queues or leaves unsigned.
The cause
File ownership or permissions on /var/cpanel/domain_keys/ got scrambled—often after a manual migration, a bad rsync, or filesystem repairs. Exim runs as user mailnull (or exim on some setups) and can't read the private key.
Fix permissions
Run this as root:
chown -R mailnull:mail /var/cpanel/domain_keys/
chmod 0640 /var/cpanel/domain_keys/private/*
Then restart Exim:
systemctl restart exim
Check the mail queue and force a retry if messages are stuck:
exim -qff
Monitor /var/log/exim_mainlog while a test email goes out. The permission error should be gone.
Error 6: Multiple conflicting DKIM records in DNS
Email Deliverability shows valid, but Gmail and other receivers log dkim=permerror (multiple records) or dkim=temperror. Your DKIM check tools return "ambiguous."
Why it breaks
Two or more TXT records exist for the same DKIM selector (usually default._domainkey). This happens when you switch DNS providers, add records through different interfaces (cPanel editor and registrar panel), or restore from backups without clearing duplicates. The RFC says one record per selector—period.
Clean it up
Query DNS to see the duplicates:
dig default._domainkey.yourdomain.com TXT
If you see two answer sections or a list of values, you've got dupes. Log into your DNS management interface (Cloudflare, Route 53, cPanel DNS, wherever the nameservers point) and delete all default._domainkey TXT records.
Then add back exactly one, using the value from WHM's Email Deliverability interface. Wait a minute, verify with dig, and send a test email. The permerror disappears immediately once DNS is clean.
Error 7: DKIM works for the primary domain but not addon or subdomains
The main domain signs mail perfectly. Addon domains or subdomains on the same cPanel account show "DKIM not enabled" or send unsigned mail.
What's going on
Each domain and subdomain needs its own DKIM key pair and DNS record. cPanel doesn't automatically propagate DKIM settings to addons—you enable it per domain. Subdomains that send mail (like support.yourdomain.com) need their own default._domainkey.support.yourdomain.com record.
Enable DKIM for each domain
In WHM, go to Email Deliverability. Scroll through the domain list—addon domains and qualifying subdomains appear separately. Click Manage on each one and install the DKIM record.
For subdomains that send transactional mail, you may need to manually create the DNS entry if cPanel doesn't list it. Generate a key with:
/usr/local/cpanel/bin/dkim_keys_install subdomain.yourdomain.com
Then retrieve the public key from /var/cpanel/domain_keys/public/subdomain.yourdomain.com and add it to DNS as a TXT record at default._domainkey.subdomain.yourdomain.com.
What to check first
When DKIM breaks, start with DNS every time. Use dig or an online DKIM lookup tool to confirm the record exists, matches the server's expectation, and has no duplicates. Fix the DNS layer before touching server configs.
If DNS is clean, verify that the domain's mail routing is set to local and Exim is actually signing outbound messages—send a test to a Gmail account you control and check the raw headers for the DKIM-Signature: field.
Permissions, weak keys, and missing addon-domain configurations are less common but trivial to fix once you know where to look. Most DKIM failures resolve in under ten minutes if you follow the symptoms to the right layer.
FAQ
Can I use a custom DKIM selector instead of "default"?
Yes. In WHM's Email Deliverability interface, you can specify a custom selector when installing or regenerating DKIM. Just make sure your DNS record matches the selector name you choose.
How long does DNS propagation take for DKIM records?
TXT records usually propagate in under 5 minutes globally. If you're still seeing old values after an hour, check your TTL settings and flush your local DNS cache.
Do I need separate DKIM keys for each domain on the same server?
Yes. Each domain gets its own key pair. Sharing keys across domains breaks the authentication model and will cause validation failures.
Why does cPanel Email Deliverability show valid, but mail still fails DKIM?
The interface checks if the DNS record matches what cPanel expects. It doesn't verify that Exim is signing mail. Check your mail routing setting and Exim logs to confirm signatures are actually being added.
Can I copy DKIM keys between servers during a migration?
You can, but it's cleaner to regenerate them on the new server and update DNS. If you do copy keys, preserve file permissions and ownership exactly, and make sure the domain is listed in the new server's Exim DKIM config.
Run through the seven in order
When DKIM fails, the error messages rarely point you to the real problem. Work through these seven scenarios in sequence: check if DKIM is enabled at all, verify the signature appears in headers, match the DNS record to the server's key, confirm key strength, fix file permissions, eliminate duplicate DNS entries, and enable DKIM for every domain that sends mail.
Most of the time, it's DNS.