--- schema_version: "1" id: 49688f50bd7cbba513ccf019a918eedae35875f0f24757712acfba6b55f5273f title: Configure DKIM for B2C Commerce collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_deploy_dkim.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_deploy_dkim.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: d917e7c3a7c0ab3707c46c33dbff1809378a6d4d6a33897ba5684b95f043a17e description: Major email providers, including Google, Microsoft, and Yahoo, now require DomainKeys Identified Mail (DKIM) authentication. Configuring DKIM is essential to ensure that your emails reach customer inboxes and aren’t rejected or flagged as spam. Configure DKIM to verify that the emails come from the domain that they claim to be from. products: - Commerce - B2C Commerce release: "264" --- # Configure DKIM for B2C Commerce Major email providers, including Google, Microsoft, and Yahoo, now require DomainKeys Identified Mail (DKIM) authentication. Configuring DKIM is essential to ensure that your emails reach customer inboxes and aren’t rejected or flagged as spam. Configure DKIM to verify that the emails come from the domain that they claim to be from. [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) 1. Generate a private-public key pair, a .p12 key, for DKIM. See [Generate a Private-Public Key Pair](https://help.salesforce.com/s/articleView?id=cc.b2c_generate_private_key.htm&release=264.0.0&type=5 "DKIM authentication requires you to specify a private key in Business Manager in B2C Commerce. Generate a private key in a terminal with these commands."). 2. Import the .p12 key for DKIM. 1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Operations** | **Private Key and Certificates**. 2. Click **Import**, and then select the p12 key. 3. Provide an alias and, optionally, a password. Save the key. 3. Enable DKIM and specify a DKIM selector in Email Settings. The DKIM selector is a unique, user-defined string within the DKIM email signature that references a specific public key within your DNS records. It’s used to differentiate multiple DKIM keys on the same domain. The selector forms the prefix for your DNS TXT record, which is formatted as: .\_domainkey.. For example, if the email address is noreply@notifications.example.com and the selector is myselector, the DNS TXT record label is myselector.\_domainkey.notifications.example.com. 1. In **Administration** | **Operations** | **Email Settings**, select **Enable DKIM**. 2. For Private RSA key, select the .p12 key that you imported. 3. Enter a name for the DKIM selector. 4. Click **Apply**. Keep these considerations in mind. - The domain isn’t manually configured. Instead, it’s the same domain used when sending email. For example, noreply@notifications.example.com. - An instance can have only one private key and selector, but the same public key and selector can be used across multiple instances. - The same private-public key pair can be used across multiple domains, even on the same instance. This diagram shows that an instance has only one active private key and selector at a time for DKIM. But this single private key can be associated with multiple hostnames via the Manage Hostnames interface. ![A private key can be associated with multiple hostnames.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_dkim_multiple_domains.png) This image shows that all storefronts share the same underlying private key configured on the same instance. When hosting multiple storefronts on the same production instance, you must duplicate the public DNS TXT records for each unique subdomain. ![Multiple storefronts can share the same private key configured on the instance.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_dkim_multiple_storefronts.png) 4. Configure the DNS record for your email domain in the DNS hosting provider or domain registrar. Update the value of the DKIM TXT record entry in your DNS record. For example, with a selector named myselector for the domain notifications.example.com, enter the TXT entry in the record: `myselector._domainkey.notifications.example.com` The content of the TXT entry is a long variable. For example, `"v=DKIM1; k=rsa;" "p=MIIBIjANBgkqhk…` The TXT record is required to store the public key. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note A single string within a DNS TXT record can’t exceed 255 characters. A TXT record can hold multiple strings. If your DKIM record is longer than 255 characters, split it into multiple quoted strings within the same record. To split strings, use double-quoted characters. When an email server queries your DNS, it automatically concatenates those quoted strings into one long, unbroken public key. 1024-bit RSA keys don’t require splitting, but 2048-bit RSA keys do. #### See Also - [Support for DomainKeys Identified Mail (DKIM) Authentication](https://help.salesforce.com/s/articleView?id=cc.b2c_support_for_dkim_authentication.htm&release=264.0.0&type=5 "Salesforce B2C Commerce provides an out-of-the-box solution on our first-party Point of Deployment (POD) that customers can use for their email requirements. This service provides support for DKIM and SPF authentication. DKIM is an email authentication protocol that adds a cryptographic digital signature to outgoing emails. With DKIM, receivers can verify that the domain owner authorized the email and that it wasn’t altered in transit. DKIM helps reduce spam and phishing emails.") - [_Salesforce Help_: Private Keys and Certificates in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_certificates_and_private_keys.htm&language=en_US) - [_Wikipedia_: DomainKeys Identified Mail](https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail) - [_Wikipedia_: Sender Policy Framework](https://en.wikipedia.org/wiki/Sender_Policy_Framework) - [_Wikipedia_: DMARC](https://en.wikipedia.org/wiki/DMARC)