What is DKIM? How it works, a good record, and how to check yours
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Receivers fetch your public key from DNS at <selector>._domainkey.yourdomain.com and use it to check that the message really came from your domain and was not changed on the way.
Your email provider generates the key pair and tells you which DNS record to publish. Use a 2048-bit key where your provider supports it.
How DKIM works
- Your email provider keeps a private key and signs each outgoing message, adding a
DKIM-Signatureheader. - The header names the signing domain (
d=example.com) and a selector (s=google). - The receiver looks up the TXT record at
google._domainkey.example.comto get the public key. - It checks the signature against the message. If the body or key headers were changed, the check fails.
- A valid signature whose
d=domain matches your From domain counts as aligned DKIM for DMARC.
Example of a good DKIM record
Published as a TXT record with host google._domainkey (the public key is shortened here):
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3q...IDAQAB| Part | Meaning |
|---|---|
| Selector | A label that lets one domain have several keys, one per service or per rotation. Chosen by your provider, for example google, selector1 or s1. |
<selector>._domainkey | Where the key lives in DNS, for example selector1._domainkey.example.com. |
v=DKIM1 | Version. Optional, but if present it must be first. |
k= | Key type: rsa (default and most common) or ed25519. |
p= | The public key in base64. An empty p= means the key has been revoked. |
t= | Flags. t=y means testing mode: receivers may treat failures leniently. t=s means no subdomains. |
s= | Service type. Usually left out or email. |
| Key length | 1024-bit RSA is the minimum receivers accept and is considered weak. Use 2048-bit. Keys under 1024 bits are ignored by Gmail and others. |
| CNAME-delegated keys | Microsoft 365, SendGrid, Mailchimp and others ask you to add a CNAME (for example selector1._domainkey pointing to their domain). They host and rotate the key for you. |
| Rotation | Change keys every 6 to 12 months: publish a new selector, switch signing to it, then remove or revoke the old one. |
Common DKIM mistakes
- Publishing the record but never turning on signing
- In Google Workspace and Microsoft 365 you must click "Start authentication" or enable signing after adding the DNS record. Otherwise mail goes out unsigned.
- Using a 1024-bit or shorter key
- Short keys are easier to break and some receivers reject them. Generate a 2048-bit key if your provider allows it.
- Breaking a long key across TXT strings wrongly
- A 2048-bit key is longer than 255 characters, so it is split into several quoted strings. Extra spaces or quotes inside the key break it.
- Host name doubled by the DNS host
- Entering
google._domainkey.example.comin a host field that adds the domain createsgoogle._domainkey.example.com.example.com. Enter justgoogle._domainkey. - Third-party senders not set up
- Your newsletter or CRM signs with its own domain unless you add its DKIM records. Then DKIM does not align with your From domain and DMARC fails.
- Leaving testing mode on
t=ytells receivers you are still testing. Remove it once signing works.- Never rotating keys
- A key that has been in use for years is a bigger risk if it leaks. Rotate periodically.
How to set up DKIM
- In each email service's admin panel, find the DKIM or "domain authentication" setting.
- Generate a key (choose 2048-bit if offered). The provider shows a host name and a TXT or CNAME value.
- Add that record at your DNS host exactly as shown, using only the part before your domain in the host field.
- Wait for DNS to update (usually minutes), then click verify or start authentication in the provider.
- Send a test email to a Gmail address, open "Show original" and confirm
DKIM: PASSwith your domain.
DKIM FAQ
Why does the checker say no DKIM was found when I have it?
DKIM keys are stored under a selector name that only appears in the signature of sent mail, and DNS has no way to list them. We probe dozens of common selectors. If your provider uses a custom one, we cannot see it. Check the s= value in a DKIM-Signature header of a message you sent.
What is a DKIM selector?
A selector is a name that points to one specific DKIM key, so a domain can have several keys at once, for example one for Google Workspace (google) and one for SendGrid (s1). The key is published at selector._domainkey.yourdomain.com.
Should I use a 1024-bit or 2048-bit DKIM key?
Use 2048-bit. 1024-bit keys still work but are considered weak, and keys shorter than 1024 bits are rejected by major providers. Some older DNS hosts struggle with long TXT records; if so, split the key into multiple quoted strings.
How often should I rotate DKIM keys?
Every 6 to 12 months is a common practice. Publish a new key under a new selector, switch signing to it, wait a few days for mail in transit, then remove the old record. Providers that use CNAME-delegated keys rotate for you.
Do I need DKIM if I have SPF?
Yes. SPF breaks when mail is forwarded, but a DKIM signature survives forwarding. Gmail and Yahoo also require DKIM from bulk senders, and DMARC works best when both SPF and DKIM pass.
Can I have more than one DKIM record?
Yes, one per selector. Each service that sends for you should have its own selector and key. What you must not have is two different TXT records at the same selector name.
What does an empty p= in a DKIM record mean?
An empty p= means the key has been revoked. Any message signed with that selector will fail DKIM. If you still send with that selector, publish a new key.