cPanel DKIM Not Working

"cPanel DKIM not working" is not a standard SMTP reply code (RFC 5321) or enhanced status code (RFC 3463). It's a symptom reported by cPanel's Email Deliverability interface — typically the "Problems Exist" / "Invalid" state next to DKIM, or recipients showing dkim=fail/dkim=none in their message headers. It means the DKIM signature for your domain either isn't being applied to outbound mail or doesn't match the public key published in DNS.

What causes "cPanel DKIM not working"?

There are four common, distinct root causes:

1. DNS is not hosted on your cPanel server (most common). cPanel can only publish a DKIM record automatically when your server is the authoritative nameserver for the domain. Per cPanel's docs: "To correctly install a DKIM record, your server must be the authoritative nameserver." If your nameservers point to a registrar, Cloudflare, or another DNS host, cPanel shows a warning like "Because this is not an authoritative nameserver for the domain, the current or suggested records will not reflect your changes," and the Repair button cannot publish the key.
2. A stale, mismatched, or missing TXT record. The published default._domainkey.<domain> TXT record doesn't match the key cPanel is signing with — often left over from a previous host or a key regeneration.
3. The 255-character TXT split was pasted incorrectly. A DKIM RSA public key often exceeds the 255-character limit of a single DNS character-string (per RFC 1035 §3.3, the DNS wire-format spec). RFC 6376 §3.6.2.2 separately requires that when a TXT record is split across multiple strings, they be concatenated with no intervening whitespace before use. If your DNS provider's UI mangled the split (added spaces, dropped a chunk, or wrapped it as two separate records), the key won't parse.
4. cPanel isn't signing the outbound mail at all. A known cPanel caveat: mail sent by PHP applications via the DSO (mod_php) handler can run as a shared system user rather than the domain's account owner, which breaks the sender attribution Exim needs to pick the right DKIM key. Fixes include enabling mod_ruid2 or MPM ITK, or the relevant options in WHM's Exim Configuration Manager.

How do I fix "cPanel DKIM not working"?

Work through these in order:

1. Read the exact status in cPanel. In cPanel go to Email > Email Deliverability, find the domain, and click Manage. The DKIM row shows the current published record and the suggested record. If they differ, that mismatch is your problem.

2. If your server is authoritative, click Repair. cPanel writes the record into the local DNS zone (allow up to ~5 minutes). If Repair succeeds, you're done — skip to step 5.

3. If DNS is external, publish the record manually. When DNS is hosted off-server, Repair will not work — this is expected, not a bug to fight. In Email Deliverability, copy the suggested DKIM value. cPanel offers it in two formats:

• Full — one long string (use this if your provider auto-splits long TXT values, e.g. Cloudflare).
• Split (255-char) — pre-chunked into quoted strings for providers that require manual splitting.

Add it at your DNS provider as a TXT record:

• Name/Host: default._domainkey (cPanel's default selector is default)
• Type: TXT
• Value: v=DKIM1; k=rsa; p=MIIBIjANBgkq... (the full key cPanel shows)

4. Verify the TXT record resolves and isn't split wrong. From a terminal:

dig +short TXT default._domainkey.example.com

The returned value must concatenate to a single valid key with v=DKIM1 and a non-empty p=. An empty p= means the key is revoked (RFC 6376 §3.6.1). Confirm there is exactly one DKIM TXT record for that selector.

5. Confirm cPanel is actually signing. Send a test message to a Gmail account, open the message, and check Show original — you want DKIM: 'PASS' with domain example.com. If headers show no DKIM-Signature at all (not a failure, just absent), the issue is signing, not DNS: check that mail isn't sent via the DSO PHP handler without mod_ruid2 or MPM ITK, and validate your record with a third-party inspector such as dmarcian's DKIM Inspector.

6. Allow for propagation. DNS changes propagate per the record TTL — usually minutes to a few hours. Re-run the validation after the TTL window before assuming it's still broken.

If you send through an email API or relay (rather than cPanel's local Exim), DKIM must be configured at that provider instead — the cPanel record only signs mail that leaves through the cPanel server.