Setting Up DKIM for Multiple Domains on One Mail Server

The problem appears silently

You run one mail server for a.org, b.org, and c.org. SPF is set for each domain. DKIM is configured in amavisd. You send a test email from b.org to a Gmail address. It lands in spam or fails with no clear reason.

The issue is almost always DKIM alignment. And until you check your DMARC aggregate reports, you might not even know it is happening.

Why one DKIM key does not work for multiple domains

DKIM signs an email with a private key. The public key lives in DNS under a selector. The DKIM signature includes a "d=" tag that names the signing domain. When a receiving server verifies the signature, it checks whether that signing domain matches the From address on the email.

Here is the failure case in concrete terms:

From: user@b.org
DKIM-Signature: d=a.org

The receiving server verifies the DKIM signature and it is cryptographically valid. But d=a.org does not match the From header domain b.org. The DMARC alignment check fails. The email is treated as unauthenticated, even though DKIM itself passed.

This is the most common mistake in multi-domain mail server setups. One DKIM key, shared across all domains, always fails for the domains that do not match the signing domain in the key. This is also why checking DMARC reports matters -- if you are not looking at aggregate reports, you will not see these alignment failures. DMARCFlow monitors all your domains and alerts you when alignment drops, so you catch the problem before it affects deliverability.

The rule: the DKIM signing domain (d=) must match the From address domain for DMARC alignment to pass.

How DMARC alignment works

DMARC requires at least one of SPF or DKIM to produce an aligned result. Aligned means the authenticated identity matches the From header domain.

For DKIM, alignment is straightforward: the d= domain in the DKIM signature must be the same as (or a subdomain of) the From address domain.

For SPF, alignment is based on the MAIL FROM domain matching the From header domain. If you send from user@b.org and your SPF record covers b.org, SPF aligns. SPF does not care about your DKIM keys at all, and DKIM does not care about your SPF record. They operate independently, and both must satisfy alignment separately for DMARC to pass.

This is why DKIM causes more failures in multi-domain setups. SPF does not have a cross-domain problem because the envelope-from naturally uses the domain you are sending from. DKIM does, because one key can accidentally sign for the wrong domain.

The correct architecture: one DKIM key per domain

Each sending domain needs its own DKIM selector and private key. When amavisd (or your mail server) signs an outbound email, it must use the DKIM key corresponding to the From address domain on that specific message.

For DNS, you publish one DKIM TXT record per domain:


selector._domainkey.a.org. IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY_FOR_A_ORG"
selector._domainkey.b.org. IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY_FOR_B_ORG"
selector._domainkey.c.org. IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY_FOR_C_ORG"

Each domain has its own selector, its own key pair, and its own DNS TXT record. Without DMARC reports you have no way to confirm this is working correctly, which is why aggregate reports should be part of your setup from day one.

In amavisd-new, per-domain DKIM signing is configured through @dkim_private_key_paths or @dkim_signature_options_bysenders_maps. You map each From-address domain to its own key path, and amavisd selects the correct key at signing time. If all your domains are subdomains of one parent domain (a.example.com, b.example.com), you can sometimes share a key -- but for independent domains like a.org, b.org, c.org, each needs its own key.

With OpenDKIM, you define multiple KeyTable entries, one per domain, each pointing to its own private key file. The SigningTable maps From address domains to their respective KeyTable entries.

What about SPF -- does the same problem apply?

No. SPF checks the envelope-from domain (MAIL FROM) which is the domain you actually sent from in the SMTP transaction. This naturally matches the From header in normal sending. There is no cross-domain signing ambiguity the way there is with DKIM.

If you send from b.org, the SPF check is for b.org's SPF record. Each domain's SPF record is independent and correct by construction. SPF is per-domain in a way that DKIM is not, which is why the complexity in multi-domain setups lives entirely on the DKIM side.

Each domain also needs its own DMARC record

If a.org, b.org, and c.org are separate organizational domains, each needs its own _dmarc.domain.tld TXT record. There is no cross-domain DMARC magic.

If they are subdomains of a common parent -- a.example.com, b.example.com, c.example.com -- a single _dmarc.example.com record covers all of them, and you can often share a DKIM key across those subdomains. But for independent top-level domains, each one gets its own DMARC record.

Set up rua (aggregate report URI) on your DMARC record so you receive XML reports showing alignment status per domain. Without those reports, you are running blind.

How to validate your multi-domain DKIM setup

First, check the DNS records directly:


dig TXT selector._domainkey.domain.tld +short

If the record exists and resolves correctly, the DNS side is right.

Second, send a test to a Gmail address and view the original headers. Look for Authentication-Results. You want:


dkim=pass header.d=b.org

If you see header.d=a.org but you sent from b.org, your signing is configured for the wrong domain.

Third, read your DMARC aggregate reports. If you do not have rua configured, set that up now. The reports tell you exactly which domains are failing authentication and whether the failures are alignment issues or something else.

Fourth, use a monitoring tool that covers all your domains. DMARCFlow aggregates reports across every domain you add, shows you alignment percentages at a glance, and alerts you when a domain that was passing suddenly starts failing. For multi-domain setups this is especially useful -- one dashboard instead of parsing XML from five different providers.

Common mistakes

One DKIM key shared across all domains. This is the most frequent cause of multi-domain DMARC failures. The fix is per-domain keys, not a stronger DMARC policy.

Wrong selector name in DNS. If your mail server uses selector "mail" but your DNS record is under "default", verification fails. The selector name must match exactly between your signing configuration and your DNS record.

DMARC reports not configured. Many sysadmins publish p=reject without setting up rua. They see no failures -- until legitimate email from one of their domains stops arriving and they have no data to diagnose it. This is exactly the scenario DMARCFlow is built to prevent: silent failures that you only notice when a customer tells you their emails are not getting through.

Publishing DKIM for a.org but sending from b.org. The DKIM domain must match the From address domain exactly. If your application sets From: b.org but your mail server signs for a.org, the signature is for the wrong domain.

FAQ

Can I use one DKIM key for multiple domains?

Only if those domains share the same organizational domain (e.g., a.example.com and b.example.com, where example.com is the parent). In that case, d=example.com aligns with From: a.example.com. For independent top-level domains like a.org and b.org, one key does not work because the signing domain (d=) will not match the From address domain.

Does DMARC require separate DKIM keys for each domain?

For independent domains: yes. DMARC alignment requires the DKIM signing domain to match the From header domain. If you send from b.org, your DKIM signature must have d=b.org. Using a shared key for a.org produces a valid DKIM signature but a failed DMARC alignment check for b.org.

How do I set up per-domain DKIM in amavisd?

Create a separate private key file for each domain. In amavisd-new, use @dkim_private_key_paths to map each sending domain to its key path, or @dkim_signature_options_bysender_maps to specify per-sender signing options. Restart amavisd after changing the configuration. Verify by sending a test email and checking the Authentication-Results header for the correct header.d value.

Why does DKIM pass but DMARC fail?

This is an alignment failure, not a cryptographic failure. Your DKIM signature is valid, but the signing domain (d=) in the signature does not match your From header domain. The fix is to sign with a key corresponding to your From address domain, not to regenerate or strengthen your DKIM key.