> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailchannels.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DKIM configuration for cPanel

> Add DKIM signing to outbound mail on cPanel servers by extending the MailChannels Exim transport configuration.

DKIM signing is optional for MailChannels to function on cPanel, but it adds an authentication layer that improves deliverability. MailChannels does not modify the parts of messages you sign with DKIM, so existing signatures remain valid.

This guide assumes you have already completed the base [cPanel/WHM setup](/outbound/mta/setup-cpanel).

## Add DKIM to the Exim transport

In WHM, navigate to **Service Configuration > Exim Configuration Manager > Advanced Editor** and locate the `mailchannels_smtp` transport block in the **TRANSPORTSTART** section.

### Exim 4.93 and earlier

Append the following lines to the end of the `mailchannels_smtp` transport block:

```exim theme={null}
dkim_domain = $sender_address_domain
dkim_selector = default
dkim_canon = relaxed
dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
```

The completed transport block will look like this:

```exim Section: TRANSPORTSTART theme={null}
mailchannels_smtp:
  driver = smtp
  hosts_require_auth = *
  tls_tempfail_tryclear = true
  headers_add = X-AuthUser: ${if match {$authenticated_id}{.*@.*}\
    {$authenticated_id} {${if match {$authenticated_id}{.+}\
    {$authenticated_id@$primary_hostname}{$authenticated_id}}}}
  dkim_domain = $sender_address_domain
  dkim_selector = default
  dkim_canon = relaxed
  dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
```

### Exim 4.94 and later

Exim 4.94 introduced tainted filename restrictions that affect how `${dkim_domain}` is expanded. Use the `get_dkim_domain` Perl function instead:

```exim Section: TRANSPORTSTART theme={null}
mailchannels_smtp:
  driver = smtp
  hosts_require_auth = *
  tls_tempfail_tryclear = true
  headers_add = X-AuthUser: ${if match {$authenticated_id}{.*@.*}\
    {$authenticated_id} {${if match {$authenticated_id}{.+}\
    {$authenticated_id@$primary_hostname}{$authenticated_id}}}}
  dkim_domain = ${perl{get_dkim_domain}}
  dkim_selector = default
  dkim_canon = relaxed
  dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
```

## Apply the changes

After saving the Exim configuration, restart Exim to activate the new settings:

```bash theme={null}
/scripts/restartsrv_exim
```

Send test messages to confirm that outbound mail is being signed and that signatures validate correctly at the receiving end.