diff --git a/TODO.on.site b/TODO.on.site
index 3409510..3fbf517 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -19,3 +19,9 @@
 * Once `docker-compose -f sa-certbot.yml run new`
 * Every x < 30 days `docker-compose -f sa-certbot.yml run renew`
 * Always reload nginx `docker-compose exec nginx nginx -s reload`
+
+DKIM:
+* `docker-compose exec mailserver setup config dkim`
+* If using a subdomain, set `use_esld = false;`
+  in `mail/rspamd-override.d/dkim_signing.conf`
+* Publish key from `mail/config/rspamd/dkim/*.public.dns.txt` via DNS