agentmail-to · mikesteroonie · Jul 7, 2026
diff --git a/fern/pages/guides/domains/custom-domains.mdx b/fern/pages/guides/domains/custom-domains.mdx
@@ -245,6 +245,10 @@ A BIND zone file is a text file that contains DNS resource records in a standard
 
 Below are detailed instructions for AWS Route53, CloudFlare, and Namecheap. The instructions vary depending on whether you're using the AgentMail Console or the API directly.
 
+<Callout type="info" title="DKIM record type">
+  As of July 6, 2026, newly created domains authenticate DKIM with TXT selector records. Older domains may still show DKIM CNAME records. Always publish the exact `type`, `name`, and `value` returned by the AgentMail Console or API.
+</Callout>
+
 <Tabs>
   <Tab title="Via Console">
     If you created your domain through the [AgentMail Console](https://console.agentmail.to), the DNS records are displayed in a simplified format that's ready for copy-paste into your DNS provider.
@@ -253,10 +257,15 @@ Below are detailed instructions for AWS Route53, CloudFlare, and Namecheap. The
       <Tab title="Cloudflare">
         In the dashboard (**DNS > Records**), click **"Add record"**.
 
-        - **TXT (DMARC/SPF/DKIM):**
+        - **TXT (DMARC/SPF/DKIM for new domains):**
           - **Name:** Copy the **Name** value directly from the console.
           - **Content:** Copy the **Value** from the console.
 
+        - **CNAME (legacy DKIM only):**
+          - **Name:** Copy the **Name** value directly from the console.
+          - **Target:** Copy the **Value** from the console.
+          - **Proxy status:** Set to **DNS only**.
+
         - **MX:**
           - **Name:** Enter `@` to apply the record to the root domain.
           - **Mail server:** Copy the **Value** from the console.
@@ -267,10 +276,14 @@ Below are detailed instructions for AWS Route53, CloudFlare, and Namecheap. The
         In your hosted zone, click **"Create record"**.
 
 
-        - **TXT (DMARC/SPF):**
-          - **Record name:** Copy the **Name** value directly from the console (e.g., `_dmarc` or `mail` or `agentmail._domainkey`).
+        - **TXT (DMARC/SPF/DKIM for new domains):**
+          - **Record name:** Copy the **Name** value directly from the console (e.g., `_dmarc` or `mail` or `selector._domainkey`).
           - **Value:** Copy the **Value** from the console, ensuring it is enclosed in quotes.
 
+        - **CNAME (legacy DKIM only):**
+          - **Record name:** Copy the **Name** value directly from the console.
+          - **Value:** Copy the **Value** from the console without quotes.
+
         <Warning title="CRITICAL: Route 53 TXT Record 255 Character Limit">
           **AWS Route 53 has a 255 character maximum per string.** It will get angry at the DKIM record since it is longer than 255 chars (we use more secure encryption key so we get better deliverability with Gmail!)
 
@@ -306,10 +319,15 @@ Below are detailed instructions for AWS Route53, CloudFlare, and Namecheap. The
       <Tab title="Cloudflare">
         In the dashboard (**DNS > Records**), click **"Add record"**.
 
-        - **TXT (DMARC/SPF/DKIM):**
+        - **TXT (DMARC/SPF/DKIM for new domains):**
           - **Name:** Enter the part of the `name` before your root domain (e.g. `_dmarc`).
           - **Content:** Copy paste the `value` from the API response.
 
+        - **CNAME (legacy DKIM only):**
+          - **Name:** Enter the part of the `name` before your root domain.
+          - **Target:** Copy paste the `value` from the API response.
+          - **Proxy status:** Set to **DNS only**.
+
         - **MX:**
           - **Name:** Enter the part of the name before your root domain
           - **Mail server:** Enter the `value` from the API.
@@ -319,9 +337,13 @@ Below are detailed instructions for AWS Route53, CloudFlare, and Namecheap. The
       <Tab title="AWS Route 53">
         In your hosted zone, click **"Create record"**.
 
-        - **TXT (DMARC/SPF/DKIM):**
-          - **Record name:** Enter the part of the `name` before your root domain (e.g., `_dmarc` for a `name` of `_dmarc.domain.com`, or `mail` for a `name` of `mail.domain.com`, or `agentmail._domainkey` for a `name` of agentmail._domainkey.agents.com).
-          - **Value:** Can copy paste the`value` from the API, ensuring it is enclosed in quotes.
+        - **TXT (DMARC/SPF/DKIM for new domains):**
+          - **Record name:** Enter the part of the `name` before your root domain (e.g., `_dmarc` for a `name` of `_dmarc.domain.com`, or `mail` for a `name` of `mail.domain.com`, or `selector._domainkey` for a `name` of `selector._domainkey.agents.com`).
+          - **Value:** Copy paste the `value` from the API, ensuring it is enclosed in quotes.
+
+        - **CNAME (legacy DKIM only):**
+          - **Record name:** Enter the part of the `name` before your root domain.
+          - **Value:** Copy paste the `value` from the API without quotes.
 
         <Warning title="CRITICAL: Route 53 TXT Record 255 Character Limit">
           **AWS Route 53 has a 255 character maximum per string.** It will get angry at the DKIM record since it is longer than 255 chars (we use more secure encryption key so we get better deliverability with Gmail!)

diff --git a/fern/pages/knowledge-base/custom-domain-setup.mdx b/fern/pages/knowledge-base/custom-domain-setup.mdx
@@ -26,10 +26,10 @@ import { AgentMailClient } from "agentmail";
 
 const client = new AgentMailClient({ apiKey: "am_..." });
 
-// Add your domain
+// add your domain
 const domain = await client.domains.create("yourcompany.com");
 
-// View the DNS records you need to add
+// view the DNS records you need to add
 for (const record of domain.records) {
   console.log(`${record.type} | ${record.name} | ${record.value}`);
 }
@@ -42,9 +42,15 @@ The response includes all the DNS records you need to add at your DNS provider.
 | Record type | Purpose |
 | --- | --- |
 | TXT (SPF) | Authorizes AgentMail to send email on behalf of your domain |
-| CNAME (DKIM) | Cryptographic signature proving emails are authentically from you |
+| TXT (DKIM) | Publishes the custom DKIM selector key used to sign your email |
+| CNAME (DKIM) | Legacy DKIM record type for older domains |
+| TXT (DMARC) | Defines how receivers handle authentication failures |
 | MX | Routes incoming mail for your domain to AgentMail |
 
+<Note>
+As of July 6, 2026, newly created domains authenticate DKIM with TXT selector records. Older domains may still show DKIM CNAME records. Always add the exact record type, name, and value shown in the AgentMail Console or API response.
+</Note>
+
 <Note>
 The MX record is only needed if you want to **receive** emails on your custom domain. If you only need to send, you can skip the MX record.
 </Note>

diff --git a/fern/pages/knowledge-base/dns-cloudflare.mdx b/fern/pages/knowledge-base/dns-cloudflare.mdx
@@ -24,21 +24,20 @@ slug: knowledge-base/dns-cloudflare
 If you already have an SPF record for your domain, do **not** create a second one. Instead, add `include:agentmail.to` to your existing SPF record. Having multiple SPF records on the same domain will cause authentication failures.
 </Warning>
 
-## Adding a CNAME Record (DKIM)
+## Adding a DKIM Record
 
 | Field | Value |
 | --- | --- |
-| Type | `CNAME` |
-| Name | The DKIM selector from AgentMail (e.g., `agentmail._domainkey`) |
-| Target | The DKIM target from AgentMail |
-| Proxy status | **DNS only** (grey cloud) |
+| Type | `TXT` for new domains; `CNAME` for legacy domains if AgentMail shows CNAME |
+| Name | The DKIM selector host from AgentMail (e.g., `selector._domainkey`) |
+| Content or Target | The DKIM value from AgentMail |
 | TTL | `Auto` |
 
-<Warning>
-DKIM CNAME records **must** have Cloudflare proxy disabled (grey cloud icon). If the orange cloud proxy is enabled, Cloudflare replaces the CNAME with its own proxy addresses, which prevents email servers from looking up your DKIM public key. This will cause DKIM verification to fail. If you see Error 1004 when saving, confirm that proxy is set to DNS only.
-</Warning>
+Cloudflare automatically strips your domain from the Name field. Enter only the selector host portion (e.g., `selector._domainkey`), not the full `selector._domainkey.yourdomain.com`.
 
-Cloudflare automatically strips your domain from the Name field. Enter only the subdomain portion (e.g., `agentmail._domainkey`), not the full `agentmail._domainkey.yourdomain.com`.
+<Note>
+As of July 6, 2026, newly created domains authenticate DKIM with TXT selector records. Older domains may still show DKIM CNAME records. Add the exact type and value shown in AgentMail.
+</Note>
 
 ## Adding an MX Record (Receiving)
 
@@ -60,12 +59,10 @@ Cloudflare DNS typically propagates within **1 to 5 minutes**, making it one of
 
 ## Common Cloudflare Issues
 
-- **Proxy must be off for CNAME records:** The orange cloud (Proxied) means traffic goes through Cloudflare's reverse proxy, which only handles HTTP/HTTPS. Email-related CNAME records like DKIM need direct DNS resolution and must be set to DNS only (grey cloud). If you forget, DKIM verification will silently fail.
-
-- **CNAME flattening at root:** Cloudflare automatically flattens CNAME records at the zone apex (root domain), returning A/AAAA records instead of the CNAME. This generally does not affect DKIM setup since the selector (e.g., `agentmail._domainkey`) is a subdomain. However, if you encounter unexpected behavior, consider using a subdomain for sending.
-
 - **Existing SPF record:** If you already have a TXT record starting with `v=spf1`, add `include:agentmail.to` before the `~all` or `-all` in that existing record. Do not create a second SPF TXT record.
 
-- **Error 1004 when adding CNAME:** This error typically means the record cannot be proxied. Switch the proxy status to DNS only (grey cloud) and try saving again.
+- **Legacy DKIM CNAME proxy:** If AgentMail shows a DKIM CNAME record, set the proxy status to **DNS only** (grey cloud). Proxied CNAME records will break DKIM verification.
+
+- **Duplicate TXT values:** Cloudflare lets you add TXT records with the same name, but duplicate SPF or stale DKIM selector records can make verification fail. Keep only the current values AgentMail provides for each host.
 
-- **Name field auto-strips domain:** Cloudflare removes the domain portion from the Name field automatically. If your DKIM selector is `agentmail._domainkey`, enter just that. Do not enter `agentmail._domainkey.yourdomain.com`, or the record will be created incorrectly.
+- **Name field auto-strips domain:** Cloudflare removes the domain portion from the Name field automatically. If your DKIM selector is `selector._domainkey`, enter just that. Do not enter `selector._domainkey.yourdomain.com`, or the record will be created incorrectly.
diff --git a/fern/pages/knowledge-base/dns-godaddy.mdx b/fern/pages/knowledge-base/dns-godaddy.mdx
@@ -24,19 +24,23 @@ slug: knowledge-base/dns-godaddy
 GoDaddy automatically wraps TXT values in double quotes, so do **not** add your own quotes around the value. If you do, the record will end up double-quoted and fail validation. Also, if you already have an SPF record, add `include:agentmail.to` to the existing record rather than creating a second one.
 </Warning>
 
-## Adding a CNAME Record (DKIM)
+## Adding a DKIM Record
 
 | Field | Value |
 | --- | --- |
-| Type | `CNAME` |
-| Name | The DKIM selector from AgentMail (e.g., `agentmail._domainkey`) |
-| Value | The DKIM target from AgentMail |
+| Type | `TXT` for new domains; `CNAME` for legacy domains if AgentMail shows CNAME |
+| Name | The DKIM selector host from AgentMail (e.g., `selector._domainkey`) |
+| Value | The DKIM value from AgentMail |
 | TTL | `1 Hour` |
 
 <Warning>
-GoDaddy automatically appends your domain to the Name field. Enter only the subdomain portion. For example, enter `agentmail._domainkey`, not `agentmail._domainkey.yourdomain.com`.
+GoDaddy automatically appends your domain to the Name field. Enter only the selector host portion. For example, enter `selector._domainkey`, not `selector._domainkey.yourdomain.com`.
 </Warning>
 
+<Note>
+As of July 6, 2026, newly created domains authenticate DKIM with TXT selector records. Older domains may still show DKIM CNAME records. Add the exact type and value shown in AgentMail.
+</Note>
+
 ## Adding an MX Record (Receiving)
 
 | Field | Value |
@@ -59,7 +63,7 @@ GoDaddy DNS typically propagates within **15 to 30 minutes**, but it can occasio
 
 - **Double-quoted TXT values:** GoDaddy adds quotes around TXT records automatically. If you paste a value that already includes quotes, the final record will be double-quoted and will fail. Paste the raw value without quotes.
 
-- **Name field auto-appends domain:** GoDaddy appends your domain to the Name field. Enter only the subdomain portion (e.g., `agentmail._domainkey`). If you enter the full hostname, it will be duplicated as `agentmail._domainkey.yourdomain.com.yourdomain.com`.
+- **Name field auto-appends domain:** GoDaddy appends your domain to the Name field. Enter only the selector host portion (e.g., `selector._domainkey`). If you enter the full hostname, it will be duplicated as `selector._domainkey.yourdomain.com.yourdomain.com`.
 
 - **Existing SPF record:** If you already have a TXT record starting with `v=spf1`, add `include:agentmail.to` before the `~all` or `-all` in that existing record. Do not create a second SPF TXT record.
 

diff --git a/fern/pages/knowledge-base/dns-namecheap.mdx b/fern/pages/knowledge-base/dns-namecheap.mdx
@@ -28,19 +28,23 @@ Make sure your domain is using **Namecheap BasicDNS** or **Namecheap PremiumDNS*
 If you already have an SPF record for your domain, do **not** create a second one. Instead, add `include:agentmail.to` to your existing SPF record. Having multiple SPF records will cause validation failures.
 </Warning>
 
-## Adding a CNAME Record (DKIM)
+## Adding a DKIM Record
 
 | Field | Value |
 | --- | --- |
-| Type | `CNAME Record` |
-| Host | The DKIM selector from AgentMail (e.g., `agentmail._domainkey`) |
-| Value | The DKIM target from AgentMail |
+| Type | `TXT Record` for new domains; `CNAME Record` for legacy domains if AgentMail shows CNAME |
+| Host | The DKIM selector host from AgentMail (e.g., `selector._domainkey`) |
+| Value | The DKIM value from AgentMail |
 | TTL | `Automatic` |
 
 <Warning>
-**Namecheap automatically appends your domain to the Host field.** Enter only the subdomain portion. For example, enter `agentmail._domainkey`, not `agentmail._domainkey.yourdomain.com`.
+**Namecheap automatically appends your domain to the Host field.** Enter only the selector host portion. For example, enter `selector._domainkey`, not `selector._domainkey.yourdomain.com`.
 </Warning>
 
+<Note>
+As of July 6, 2026, newly created domains authenticate DKIM with TXT selector records. Older domains may still show DKIM CNAME records. Add the exact type and value shown in AgentMail.
+</Note>
+
 ## Adding an MX Record (Receiving)
 
 | Field | Value |
@@ -61,7 +65,7 @@ Namecheap DNS typically propagates within **15 to 30 minutes**, but in some case
 
 ## Common Namecheap Issues
 
-- **Host field auto-appends domain:** Namecheap adds your domain automatically. If your DKIM selector is `agentmail._domainkey`, enter just that, not the full `agentmail._domainkey.yourdomain.com`. If you enter the full value, the actual record will end up as `agentmail._domainkey.yourdomain.com.yourdomain.com`.
+- **Host field auto-appends domain:** Namecheap adds your domain automatically. If your DKIM selector is `selector._domainkey`, enter just that, not the full `selector._domainkey.yourdomain.com`. If you enter the full value, the actual record will end up as `selector._domainkey.yourdomain.com.yourdomain.com`.
 
 - **Existing SPF record:** If you already have a TXT record starting with `v=spf1`, add `include:agentmail.to` before the `~all` or `-all` in that existing record. Do not create a second SPF TXT record.
 

diff --git a/fern/pages/knowledge-base/dns-route53.mdx b/fern/pages/knowledge-base/dns-route53.mdx
@@ -28,16 +28,20 @@ If your domain is registered with a different registrar but uses Route 53 for DN
 Route 53 requires TXT values to be **wrapped in double quotes**. If you omit the quotes, the record will fail validation. Also, if you already have an SPF record, add `include:agentmail.to` to the existing record rather than creating a second one. Multiple SPF records on the same domain will cause authentication failures.
 </Warning>
 
-## Adding a CNAME Record (DKIM)
+## Adding a DKIM Record
 
 | Field | Value |
 | --- | --- |
-| Record name | The DKIM selector from AgentMail (e.g., `agentmail._domainkey`) |
-| Record type | `CNAME` |
-| Value | The DKIM target from AgentMail |
+| Record name | The DKIM selector host from AgentMail (e.g., `selector._domainkey`) |
+| Record type | `TXT` for new domains; `CNAME` for legacy domains if AgentMail shows CNAME |
+| Value | The DKIM value from AgentMail |
 | TTL | `300` |
 
-CNAME values should **not** be wrapped in quotes.
+Route 53 requires TXT values to be **wrapped in double quotes**. CNAME values should not be wrapped in quotes. If a DKIM TXT value is longer than 255 characters, split it into adjacent quoted strings within one TXT record.
+
+<Note>
+As of July 6, 2026, newly created domains authenticate DKIM with TXT selector records. Older domains may still show DKIM CNAME records. Add the exact type and value shown in AgentMail.
+</Note>
 
 ## Adding an MX Record (Receiving)
 
@@ -60,17 +64,15 @@ Route 53 name servers typically pick up changes within **60 seconds**, but full
 
 ## Common Route 53 Issues
 
-- **TXT records must be quoted:** Unlike most DNS providers, Route 53 requires double quotes around TXT record values. If your SPF or other TXT records are missing quotes, they won't validate.
-
-- **CNAME at root domain:** Route 53 does not allow CNAME records on the root domain (zone apex). If you need to set up DKIM, the selector (e.g., `agentmail._domainkey`) is a subdomain, so this is typically not an issue. However, if you run into conflicts, consider using a subdomain for sending.
+- **TXT records must be quoted:** Unlike most DNS providers, Route 53 requires double quotes around TXT record values. If your SPF, DKIM, or DMARC TXT records are missing quotes, they won't validate.
 
 - **Existing SPF record:** If you already have a TXT record starting with `v=spf1`, add `include:agentmail.to` before the `~all` or `-all` in that existing record. Do not create a second SPF TXT record.
 
 - **Routing policy:** When creating records, use **Simple routing** unless you have a specific reason to use weighted, latency, or other routing policies. Other policies can cause unexpected DNS behavior for email records.
 
 - **Multiple values in one record:** Route 53 lets you add multiple values to a single record. If you need to add a second MX entry, add it as a new line in the same MX record rather than creating a separate record.
 
-- **DKIM TXT record too long (CharacterStringTooLong error):** If your DKIM record is provided as a TXT value (rather than a CNAME), the DKIM public key is often longer than the 255-character limit that Route 53 enforces per string segment. You will see an error like `CharacterStringTooLong (Value is too long)`. To fix this, split the value into two quoted strings within a single record. The split point should be near the middle of the `p=` value. The two quoted strings must have **no space and no line break** between the closing and opening quotes. For example:
+- **DKIM TXT record too long (CharacterStringTooLong error):** DKIM public keys are often longer than the 255-character limit that Route 53 enforces per string segment. You will see an error like `CharacterStringTooLong (Value is too long)`. To fix this, split the value into two quoted strings within a single record. The split point should be near the middle of the `p=` value. The two quoted strings must have **no space and no line break** between the closing and opening quotes. For example:
 
   ```
   "v=DKIM1; k=rsa; p=MIIBIjANBgkqhki...firsthalf""secondhalf...wIDAQAB"