How to Enable DKIM and DNSSEC for a Domain in ISPConfig

This guide shows you how to switch on two signing features for a domain in the ISPConfig control panel: DKIM, which digitally signs the email your domain sends, and DNSSEC, which digitally signs the domain's DNS zone. DKIM is short for DomainKeys Identified Mail, and DNSSEC for Domain Name System Security Extensions; turning on DNSSEC is often described as "signing the zone". It is written for Noiz clients managing their own hosting account through ISPConfig. The two features are independent, so you can enable either one on its own, but they work well together and this guide covers both. DKIM matters for deliverability, because the large mailbox providers now expect a valid DKIM signature on the mail you send, and unsigned messages are far more likely to land in the spam folder or be rejected. DNSSEC protects the DNS answers themselves, so resolvers around the world can detect a forged or tampered reply for your domain.

Last reviewed: 27 July 2026, against ISPConfig 3.3.1p1. This guide is written for Noiz hosting and is kept current against ISPConfig. It complements, and does not replace, the official ISPConfig documentation linked below.

Official Documentation Reference

• ISPConfig Documentation overview: the index of all official ISPConfig documentation, including the full manual that describes the DKIM and DNSSEC fields.
• My First Email (ISPConfig 3 Documentation): the official walkthrough of the Email module, where the mail domain and its DKIM settings live.
• DNS Basics (ISPConfig 3 Documentation): the official primer on how the DNS module and DNS zones work in ISPConfig.
• How to change the DNSSEC algorithm in ISPConfig 3 (FAQforge): maintained by an ISPConfig core developer; explains the per-zone DNSSEC algorithm choice and how the DS data for the registry is generated.

Prerequisites

• You can log in to the ISPConfig control panel.
• For the DKIM part, an email domain already exists on your account. If you have already created an email mailbox in ISPConfig, the email domain is already in place.
• For the DNSSEC part, and for the DKIM DNS record to be published automatically, the domain's DNS zone must be hosted in the DNS module of ISPConfig on your Noiz account. If your DNS is hosted elsewhere, you can still enable DKIM and copy the record across by hand, but zone signing has to be done wherever the DNS is actually hosted.
• For DNSSEC you also need a way to publish DS data at the domain's registry: either access to the DNSSEC settings at your domain registrar, or, if the domain is registered through Noiz, a support ticket asking for the DS data to be published.

Part 1: Enable DKIM for Your Mail Domain

DKIM works with a key pair. The private key stays on the mail server and adds a hidden signature to every message sent from your domain. The matching public key is published in DNS, where any receiving mail server can fetch it and confirm the signature is genuine. Alongside an SPF record, which lists the servers allowed to send for your domain, and a DMARC policy, which tells receivers what to do when a check fails, a passing DKIM signature is one of the strongest signals you can send that your mail is legitimate.

Step 1: Open the DKIM settings

1. Log in to ISPConfig and click the Email module in the top navigation.
2. In the left-hand menu, under Email Accounts, click Domain. A list of your email domains appears.
3. Click the domain you want to sign mail for, for example the example domain yourdomain.com.
4. On the domain form, click the DomainKeys Identified Mail (DKIM) button below the main fields. The DKIM settings are collapsed behind it and stay hidden until you click it.

Step 2: Generate the key and enable signing

1. Tick the enable DKIM checkbox.
2. Leave the DKIM-Selector field set to default, which is the value ISPConfig pre-fills. The selector names the key instance and becomes part of the DNS record name; you only need a different selector if you run more than one key for the same domain, for example when rotating keys. A selector must be lower-case letters and digits only, up to 63 characters, optionally followed by a dot and a second string of the same form.
3. Click the Generate DKIM Private-key button. After a moment, ISPConfig fills the DKIM Private-key field with a new key and the read-only DNS-Record field with the matching public record, and ticks enable DKIM for you if you have not already. The DNS-Record field holds a complete zone-file line rather than just the key: the record name, a TTL, IN TXT, and then the quoted value beginning v=DKIM1. If you already hold a DKIM key pair from a previous setup, you can paste the private key into the DKIM Private-key field instead of generating a new one.
4. Copy the contents of the DNS-Record field somewhere safe. You will need it in the next step if your DNS is hosted outside ISPConfig.
5. Click Save.

From this point on, the mail server signs every outgoing message from every mailbox on the domain automatically. Nothing changes for the people using the mailboxes; the signature travels invisibly in the message headers.

Step 3: Publish the DKIM record in DNS

The signature only passes verification once the public key is available in DNS as a TXT record. Where you add that record depends on where the domain's DNS is hosted.

If the DNS zone is hosted in ISPConfig on your Noiz account, the record is added for you, provided the mail domain itself is set to Active. When ISPConfig recognises the zone as one it manages, a small link icon appears beside the DNS-Record label with the tooltip Managed zone, dns updated automatically. To confirm the record:

1. Click the DNS module in the top navigation, then click Zones under DNS in the left-hand menu.
2. Click the zone for your domain and open the Records tab.
3. Look in the Name column for a TXT record called default._domainkey.yourdomain.com., with the trailing dot, whose data begins with v=DKIM1.

If the record has not appeared, you can add it with the built-in wizard. On the Records tab, click the DKIM button. Every field except TTL is read-only: the Public-Key and DKIM-Selector values are filled in automatically from the email domain settings. Click Save and the record is stored as a TXT record in the zone. The wizard refuses with DKIM disabled for this mail-domain if DKIM is not enabled on the email domain yet, and with DNS-Record already exists if the record is in fact already there.

If the domain's DNS is hosted elsewhere, log in to that DNS provider and create a TXT record with the host name default._domainkey (some providers want the full name, default._domainkey.yourdomain.com) and, as its value, the text from the DNS-Record field beginning with v=DKIM1.

Step 4: Test the signature

1. Allow time for the DNS change to spread. A record in a Noiz-hosted zone is usually visible within minutes; records at outside providers can take up to 24 hours.
2. Send a message from a mailbox on the domain, using webmail or a mail program that sends through the Noiz mail server with SMTP authentication, to an address you control at one of the large mail providers.
3. Open the received message's full headers and find the Authentication-Results line. You want to see dkim=pass together with your domain name.

You can also use any online DKIM checker: give it your domain and the selector default, and it will confirm whether the public key record is visible.

Part 2: Sign the DNS Zone with DNSSEC

DNSSEC adds digital signatures to the DNS zone itself, so a resolver can prove that the DNS answers it receives for your domain, including the mail and DKIM records you have just set up, have not been forged or altered on the way. Signing happens in two stages: first ISPConfig signs the zone on the name server, then you publish a small piece of data called a DS record at the domain's registry to complete the chain of trust. A signed zone without the DS record published is harmless, so you can enable signing safely and publish the DS data when you are ready. DNSSEC can be switched on per zone, and only for primary zones that ISPConfig hosts.

Step 1: Turn on zone signing

1. Click the DNS module in the top navigation, then click Zones under DNS in the left-hand menu.
2. Click the zone for your domain. Zone names are listed with a trailing dot, for example yourdomain.com., which is normal DNS notation.
3. On the DNS Zone tab, tick the Sign zone (DNSSEC) checkbox.
4. Check the DNSSEC Algorithm setting directly below it. This is a set of tick boxes rather than a single choice, and 13 (ECDSAP256SHA256) is ticked by default, which is the algorithm you want. The other option, 7 (NSEC3RSASHA1), is based on the ageing SHA-1 hash and is best avoided; tick it only for the rare registry that cannot accept algorithm 13. Ticking both signs the zone under both algorithms and generates a separate key pair for each.
5. Click Save.

The server now generates the signing keys and signs the zone in the background. Watch for the small red change counter near the top of the panel, which you can click to see the outstanding changes listed; the work is normally finished within a few minutes of it clearing.

Step 2: Copy the DS data for the registry

1. Go back to Zones and open the zone again.
2. On the DNS Zone tab, the read-only DNSSEC DS-Data for registry field now contains the data for the signed zone. It is laid out in two blocks: a DS-Records: block, which is the part the registry needs, and below a divider a DNSKEY-Records: block holding the public keys themselves. If the field is still empty, wait a few minutes and reopen the zone, because the data is produced by a background process on the server.
3. Copy the whole field. Registrars usually ask for the values from the DS lines: the key tag, the algorithm number (13), the digest type (2, meaning SHA-256) and the digest itself. The key-signing key is the entry marked 257.
4. Publish the DS data at the domain's registry. If you manage the domain at an outside registrar, paste the values into its DNSSEC or DS record screen. If the domain is registered through Noiz, open a support ticket, paste in the full contents of the DNSSEC DS-Data for registry field, and ask for it to be published. The .co.za registry supports DNSSEC, as do most common domain extensions, but a few registries still do not; your registrar can confirm.

Step 3: Verify the chain of trust

1. Wait for the registry to publish the DS record. This can take from a few minutes to a day, depending on the registrar.
2. Test the domain with an online DNSSEC analyser such as DNSViz (dnsviz.net) or a similar checker. A healthy setup is reported as secure, with an unbroken chain from the root zone down to your domain.
3. If you are comfortable with the command line, you can also query a validating resolver directly, replacing yourdomain.com with your own domain:

dig +dnssec yourdomain.com A

In the answer, the ad (authenticated data) flag in the header shows that the resolver validated the response against your DNSSEC signatures.

Changing or disabling DNSSEC later

Once the DS record is published at the registry, the signatures in your zone must always match it. Never untick Sign zone (DNSSEC), delete the zone, change the signing algorithm, or move the domain's DNS hosting elsewhere while the DS record is still published: validating resolvers across the internet would treat every answer for the domain as forged, and the domain would stop resolving for a large share of visitors. ISPConfig itself guards the checkbox, raising a confirmation dialog that explains what becomes of the existing keys before it will let you untick it; read that dialog rather than clicking past it. The safe order is always the reverse of setup. Remove the DS record at the registrar first, wait at least a day for resolvers to notice, and only then change the zone. The same applies before transferring the domain to another registrar or DNS host. If you are unsure, open a support ticket before changing anything.

Troubleshooting

• The DKIM fields cannot be edited: the DomainKeys Identified Mail (DKIM) button is always on the mail domain form, so if nothing appears, click it again to expand the section. If the fields appear but are locked, your login may not have permission to change DKIM settings on this domain. Open a support ticket to have it checked.
• DKIM is enabled but online checkers cannot find the record: the DNS record has not been published yet or has not spread. Confirm the default._domainkey TXT record exists in the zone (Step 3 of Part 1), check you used the selector default in the checker, and allow up to 24 hours for records hosted at outside providers.
• Received mail shows dkim=fail or no signature at all: make sure the message was sent through the Noiz mail server with SMTP authentication. Mail sent through a third-party service, or by a website contact form using its own sending route, is not signed by this key. Also confirm enable DKIM is still ticked and the change was saved.
• The DNSSEC DS-Data for registry field stays empty: the signing process has not finished. Wait a few minutes and reopen the zone. If it is still empty after half an hour, untick Sign zone (DNSSEC), click Save, wait for the change counter to clear, then tick it again and save, which is the sequence the official ISPConfig manual recommends for this. If the field remains empty, open a support ticket: the usual cause is the server running short of entropy while generating the keys, which has to be fixed server-side.
• There is no Sign zone (DNSSEC) checkbox on the DNS Zone tab: ISPConfig hides the entire DNSSEC block, checkbox, algorithm and DS-Data field alike, when the name server holding the zone has mirror servers configured. That is a property of the platform rather than of your account, so open a support ticket to ask whether the zone can be signed.
• The registrar rejects the DS data: some registries only accept certain algorithms or digest types, and a few domain extensions do not support DNSSEC at all. Ask the registrar which algorithms it accepts; if it cannot take algorithm 13, the zone can be re-signed with the older algorithm instead.
• The domain stopped resolving for some visitors after a DNSSEC change: the DS record at the registry no longer matches the keys the zone is served with. Unticking and re-ticking Sign zone (DNSSEC) will not repair it, because that re-signs with the keys already on the server and produces exactly the same DS data; what does change the keys is switching the algorithm, renaming the zone or deleting it. Open a support ticket straight away and include the current contents of the DNSSEC DS-Data for registry field.

If you get stuck at any point, open a support ticket with the Noiz support team and include the domain name, whether the problem is with DKIM or DNSSEC, and a copy of the DNS-Record or DNSSEC DS-Data for registry value from the panel.