iCloud Mail custom domain: DKIM CNAME host rejected

Question

Kenny Millar Author

Level 2

334 points

iCloud Mail custom domain: DKIM CNAME host rejected

I am trying to add a custom (owned) domain to icloud email using icloudplus.

I am stuck at just one specfic point, when trying to update my domain DNS records.

I am following the instructions at: https://support.apple.com/en-us/102374

It says to add a cname record for DKIM like this:

But my domain registrar rejects "sig1._domainkey" as not a valid host.

I wondered if "_domainkey" is supposed to be replaced with something, so I tried:

Host: sig.myrealdomain.com
Value: sig1.dkim.myrealdomain.com.at.icloudmailadmin.com.

But that does not work. When I verify the settings at icloudplus it tells me to check my DKIM record and sends me back to the instructions I linked to above.

Can someone show me the correct host/value pair to use, assuming my domain is "myrealdomain.com" ?

Thank you.

MacBook Pro 13″, macOS 12.7

Posted on Feb 19, 2026 2:07 PM

Reply

Answer 1

g_wolfman

Level 4

3,522 points

Feb 21, 2026 2:11 PM in response to Kenny Millar

Who is managing your DKIM keys? DKIM is always a TXT record. Entering DKIM as a CNAME record is a special case that only makes sense if your DKIM management is being provided by a vendor - because the CNAME record in that case points somewhere else where the real DKIM record is held.

Is there an enterprise service provider hosting DKIM for you?

Reply

Answer 2

Kenny Millar Author

Level 2

334 points

Feb 20, 2026 3:18 AM in response to g_wolfman

I don't think that is correct. The apple docs cleary state (as shown above) to create a CNAME record with the DKIM values in. (check the link I gave).

I spoke to my domain registrar and they sugges that I append my domain name to the end of the host, like this:

sig1._domainkey.myrealdomain.com

I will try that and report back.

Reply

Answer 3

g_wolfman

Level 4

3,522 points

Feb 19, 2026 5:44 PM in response to Kenny Millar

DKIM is a TXT record, not a CNAME record. That's likely your problem - the format of a DKIM record would absolutely be rejected as a malformed Canonical nAME. Not to mention not actually being a DKIM record at all, which is why iCloud+ can't resolve it.

https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-dkim-record/ - see the section titled, "What is a DKIM record".

And just to be explicit about it - Apple's support article is wrong. SPF, DKIM and DMARC records are all always TXT, never CNAME.

Reply