Proofpoint DKIM setup: outbound signing and DNS verification

Proofpoint DKIM setup is not a copy-and-paste universal DNS value. The selector and public key depend on your Proofpoint tenant, product, and outbound configuration.

Proofpoint Essentials documentation describes DKIM as available for outbound configuration and requiring a DNS update for the domain. That means the right process is: confirm Proofpoint signs outbound mail for your domain, get the exact DKIM record from Proofpoint, publish it in DNS, then verify real messages.

Before you start

First confirm mail flow.

Proofpoint may be used for:

• Inbound filtering only.
• Outbound relay only.
• Both inbound and outbound.
• Microsoft 365 or Google Workspace integration.

DKIM signing matters only for outbound mail. If Microsoft 365 signs before Proofpoint and Proofpoint does not alter the message, Microsoft DKIM may be enough. If Proofpoint modifies or relays outbound mail, you need to test whether DKIM still passes after the Proofpoint hop.

Step 1: identify the signing point

Decide which platform should sign each message stream:

• Microsoft 365 DKIM for Microsoft mailbox mail.
• Google Workspace DKIM for Gmail mail.
• Proofpoint DKIM for mail that Proofpoint signs or modifies.

Avoid blindly enabling every possible signer. Multiple DKIM signatures are allowed, but you need at least one aligned signature that survives delivery.

Step 2: get Proofpoint’s DKIM selector and record

In your Proofpoint admin area, reseller portal, or support ticket, request DKIM signing for your sending domain.

You need:

• The selector, for example a value used before ._domainkey.
• The DNS record type, usually TXT or CNAME depending on the product configuration.
• The host name.
• The full public key or target value.
• Confirmation that signing is enabled after DNS validates.

Do not invent a selector. Do not copy another customer’s DNS record.

Step 3: publish the DNS record

At your DNS provider, add the record Proofpoint gives you.

For a TXT-style DKIM record, the host usually looks like:

selector._domainkey

The value usually begins with:

v=DKIM1; k=rsa; p=...

For a CNAME-style setup, Proofpoint will provide a host and a target. Publish the exact values.

Step 4: enable or confirm signing

After DNS is live, return to Proofpoint and enable signing or ask Proofpoint support to confirm it is enabled.

Do not stop at DNS. DKIM needs both sides: the public DNS key and the private signing configuration in Proofpoint.

Step 5: verify DMARC alignment

Send a test message through the exact outbound route you use in production.

Inspect the message headers:

• DKIM should pass.
• At least one DKIM d= domain should align with the visible From domain.
• SPF should pass if Proofpoint is also in your SPF record.
• DMARC should pass.

Then check your domain with DMARCTrust and watch DMARC aggregate reports in your dashboard.

Common mistakes

Configuring DKIM for inbound-only Proofpoint. DKIM signing is an outbound concern.

Publishing DNS but not enabling signing. The public key alone does nothing.

Letting footers break upstream DKIM. If Proofpoint adds disclaimers or rewrites content after Microsoft or Google signs, the original DKIM signature can fail.

Using SPF as the only control. SPF can pass but not align. DKIM is often the safer path for DMARC.

Related SPF setup

If Proofpoint sends outbound mail, add the correct regional include to your SPF record. See Proofpoint SPF setup.

After SPF and DKIM are configured, build your _dmarc TXT record and publish it with reporting:

v=DMARC1; p=none; rua=mailto:[email protected];

Use DMARCTrust to identify whether Proofpoint mail is passing authentication before you enforce.

FAQ

What is the Proofpoint DKIM selector?

It is tenant-specific. Get it from Proofpoint admin settings or support.

Does Proofpoint DKIM replace Microsoft 365 DKIM?

Not necessarily. If Microsoft signs and Proofpoint does not alter the message, Microsoft DKIM can pass. Test real outbound mail to confirm.

How do I verify Proofpoint DKIM?

Send through Proofpoint, inspect headers, and confirm DKIM passes with an aligned d= domain.