I’m trying to setup DKIM CNAME records in Route53, but they aren’t working due to an underscore at the start of a subdomain. I’ve tried adding the record to Route53 zone for <domain>, for example:

record: fm1._domainkey
value: fm1.<domain>.dkim.fmhosted.com

When queried from CLI using nslookup I get:

Laptop:dir user$ nslookup fm1._domainkey.<domain>
Server:     192.168.XX.Y
Address:    192.168.XX.Y#53

** server can't find fm1._domainkey.<domain>: NXDOMAIN

I’ve been able to solve this by creating another Route53 zone for _domainkey.<domain> and delegating this with an NS record in the <domain> zone. Then records work of the form:

record: fm1
value: fm1.<domain>.dkim.fmhosted.com

I feel this is a rather kludgy workaround though, and would like to avoid having this additional Route53 zone.