MailerSend Retires DKIM TXT Records on 1 February 2027: Move to the New CNAME Records
Short answer: MailerSend fully retires DKIM TXT records on 1 February 2027. If your domain still uses the old TXT key, add the two new CNAME records from your MailerSend dashboard now so your mail keeps passing DKIM. The new keys are 2048-bit and MailerSend rotates them without DNS changes.
| Who | MailerSend |
|---|---|
| Status | confirmed |
| Dates |
|
Who is affected
MailerSend customers whose sending domain was set up with the older DKIM TXT record. Domains already on the two CNAME records need no change.
What you will see
- Expected: Authentication-Results headers show dkim=fail or dkim=none for your domain on mail sent through MailerSend.
- Expected at Gmail if DMARC then fails: 550-5.7.26 Unauthenticated email from yourdomain.com is not accepted due to domain's DMARC policy.
- Expected: more mail in spam at Gmail, which requires bulk senders to set up both SPF and DKIM.
Check your setup today
- In MailerSend, go to Email → Domains and click Manage next to your domain. See whether it asks for one DKIM TXT record (old) or two CNAME records (new).
- Look up the DKIM name shown there, for example
nslookup -type=TXT name._domainkey.yourdomain.com. A TXT answer with a key and no CNAME means you still have to migrate. - Run our checker to confirm SPF and DMARC. DKIM selector names differ per account, so take the name from the MailerSend screen.
How to fix it
- In MailerSend, go to Email → Domains and click Manage next to the domain.
- At your DNS host, create the two new CNAME records exactly as MailerSend shows them.
- Back in MailerSend, tick I have added DNS records and click Re-check now.
- Send a test to a Gmail address and open Show original: DKIM should say PASS for your domain.
- That's it: MailerSend rotates the 2048-bit keys itself from then on.
Check your domain now
After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.
Get it fixed on Fiverr
Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.
Related pages
Sources
- MailerSend newsroom: New DKIM keys (8 Sep 2026)
- Google: Email sender guidelines
- Google: Gmail SMTP errors and codes
Other upcoming changes
- Microsoft 365 SMTP AUTH: Basic Authentication Off by Default at the End of December 2026
- DMARCbis (RFC 9989): pct Is Gone, t=, np= and psd= Are New — Update Your DMARC Record
- Gmail Stops Fetching POP Mail and Ends Gmailify in January 2027: Switch to Forwarding or IMAP
- Shorter TLS Certificates for Mail Servers: Let's Encrypt 64 Days (Feb 2027), 100-Day Maximum (Mar 2027)
- April 15, 2027 Root CA Distrust: Will Your Mail Server's Certificate Still Be Trusted?
- Microsoft 365 MX Records Move to *.mx.microsoft: What Changes for New and Existing Domains
- Outlook "Promotions" Tag in Microsoft 365: What It Means for Your Newsletters and Notifications