DKIM (DomainKeys Identified Mail) is a digital signature added to every email your domain sends. The sending service signs each message with a private key, and the receiving server checks it against a public key you publish in DNS, in a DKIM record under a name called a selector. A valid signature proves the message was sent with your domain's permission and was not changed on the way.
This guide is for anyone who has to "set up DKIM" for a mailbox provider, newsletter tool or shop and wants to understand what they are publishing. It covers how the signature works, what selectors are and how to find yours, what the DKIM record contains, and how to check it. DKIM is one of three records; the SPF, DKIM and DMARC setup guide explains how they work together.
Quick answer
- What it is: a signature in a
DKIM-Signatureheader, checked against a public key in your DNS. - Where the key lives: a TXT record (or a CNAME to your provider) at
selector._domainkey.example.com. - The selector is the label before
._domainkey, such asgoogleorselector1. Each service picks its own. - Turn it on per service: in Google Workspace, Microsoft 365, your newsletter tool and your shop. DNS alone does nothing; the service has to sign.
- Use 2048-bit RSA keys where you can choose, and prefer CNAME setups that let the provider rotate keys.
- Why it matters: DKIM usually survives forwarding, which SPF does not, so it is what keeps DMARC passing in most real mail flows.
How a DKIM signature works
DKIM is defined in RFC 6376. When your mail service sends a message, it:
- Takes a hash of the message body and of selected headers (From, To, Subject, Date and others).
- Signs those hashes with a private key that never leaves the service.
- Adds a
DKIM-Signatureheader with the signature and the information a receiver needs to check it.
A shortened signature header looks like this:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google;
h=from:to:subject:date:message-id; bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVFOk4yAUoqOB…The parts that matter to you:
| Tag | Meaning |
|---|---|
d= | The signing domain. For DMARC, it must match the domain in your From line. |
s= | The selector: which key to fetch from DNS. |
h= | The headers that were signed. |
bh= / b= | The body hash and the signature itself. |
The receiver fetches the public key from s._domainkey.d (here google._domainkey.example.com), recomputes the hashes and checks the signature. If anyone changed the body or a signed header on the way, the check fails with dkim=fail.
What is a DKIM selector?
The selector lets one domain have many DKIM keys at the same time. Your mailbox provider, your newsletter tool and your helpdesk each sign with their own key, under their own selector, and receivers know which one to fetch because the signature names it in s=.
Common selectors you may see:
| Service | Typical selector | Record type |
|---|---|---|
| Google Workspace | google (you can change it) | TXT |
| Microsoft 365 | selector1 and selector2 | CNAME |
| Mailchimp | k2 and k3 | CNAME |
| SendGrid | s1 and s2 | CNAME |
| Zoho Mail | a name you choose when you add the key | TXT |
Providers change their defaults; the service's setup page always shows the exact host name and value.
How to find your DKIM selector
DNS has no list of the selectors a domain uses, so you cannot look them up from outside. Get the selector from a message instead:
- Send an email from the service to a Gmail address.
- Open it, click the three dots and choose Show original.
- Find the
DKIM-Signatureheader. The value afters=is the selector and the value afterd=is the signing domain.
In Outlook on the web, open the message, choose the three dots, then View → View message source, and search for DKIM-Signature. If there is no such header, the service is not signing at all. If d= shows the service's own domain (such as sendgrid.net or onmicrosoft.com), it signs, but not as you, and that signature will not help DMARC.
What is in a DKIM record?
The DKIM record holds the public key. With a TXT setup, it looks like this:
google._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu2k…"| Tag | Meaning |
|---|---|
v=DKIM1 | Version. Optional, but if present it must come first. |
k=rsa | Key type. rsa is the default; ed25519 is the newer alternative from RFC 8463. |
p= | The public key, base64-encoded. An empty p= means the key has been revoked. |
t=y | Optional testing flag: receivers should not treat failures differently from unsigned mail. |
A 2048-bit key is about 400 characters, longer than the 255 characters one DNS text string can hold. Most DNS panels split it into several quoted strings for you; receivers join them back together. If your panel does not, paste it as two quoted strings in one record, never as two separate records.
With a CNAME setup, you publish a pointer instead, for example selector1._domainkey.example.com pointing to a host your provider controls. The provider keeps the key behind it and can rotate it without you touching DNS, which is why most newsletter tools and Microsoft 365 use CNAMEs.
Key length and algorithm
RFC 8301 (2018) says signers must use RSA keys of at least 1024 bits and should use 2048, and it retired the old rsa-sha1 algorithm. Choose 2048 bits whenever the service offers it; Google Workspace lets you pick 1024 or 2048.
Ed25519 keys (RFC 8463) are much shorter and fit in one DNS string, but not every receiver verifies them yet. Services that use them usually sign with an RSA key as well, so a receiver that cannot check one can check the other.
How to turn on DKIM
The pattern is the same everywhere: the service generates the key, you publish the record it shows, then you tell the service to start signing.
- Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit key, publish the TXT record at
google._domainkey, wait for DNS, then click Start authentication. - Microsoft 365: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Publish the two CNAMEs it shows for your domain, then enable signing.
- Newsletter tools, shops and helpdesks: look for "authenticate your domain", "sender authentication" or "branded sending domain" in the settings. They give you CNAME records to add.
Until you finish, most services still sign with their own domain: Google with a default domain of its own, Microsoft 365 with your onmicrosoft.com domain. The message then shows dkim=pass, but for the wrong domain, so DMARC fails unless SPF saves it. Menu paths change; follow the provider's current page when it differs.
Watch out
On Cloudflare, DKIM CNAME records must be set to DNS only (grey cloud). A proxied record returns Cloudflare's addresses instead of your provider's key, and DKIM fails.
Does DKIM survive forwarding?
Usually, yes, and that is its main advantage over SPF. A server that forwards a message unchanged keeps the signature intact, while SPF fails because the forwarding server is not in your SPF record.
DKIM does break when something changes the signed parts: a mailing list that adds "[list]" to the subject or a footer to the body, a security gateway that rewrites links, or a server that re-encodes the message. ARC (Authenticated Received Chain, RFC 8617) lets such intermediaries vouch for the original result, but whether a receiver trusts it is up to the receiver.
How to check your DKIM record
The email and DNS health check tries 27 common selectors, including google, selector1, selector2, k1 to k3 and s1/s2, and reports the first key it finds.
If your provider uses a custom selector, the check says "not found" even when DKIM works, because there is no way to list selectors from outside. Confirm with the Show original method above: dkim=pass with d= set to your domain is what counts.
From a terminal, once you know the selector:
dig +short TXT google._domainkey.example.com
dig +short CNAME selector1._domainkey.example.comCommon DKIM problems
dkim=failstraight after setup. The key in DNS does not match the one the service signs with: a truncated value, a missing character from copy and paste, or a record at the wrong host name.- The record shows
example.com._domainkey.example.com. The DNS panel appended your domain to a name that already included it. - Signing with the provider's domain.
dkim=passbutd=is not yours. Finish the custom-domain setup in that service. - A key revoked by mistake. An empty
p=tells receivers the key is withdrawn. - An old 1024-bit key. It still works, but rotate to 2048 when the provider allows; many do it for you with CNAME setups.
Questions people ask
What is DKIM?
DKIM is a digital signature added to every message you send. The sending service signs with a private key, and receivers check the signature against a public key you publish in DNS under a selector, such as google._domainkey.example.com. A valid signature proves the message came from your domain and was not changed on the way. Turn it on in each service that sends for you.
What does DKIM stand for?
DKIM stands for DomainKeys Identified Mail. It grew out of two earlier systems, Yahoo's DomainKeys and Cisco's Identified Internet Mail, which were merged and published by the IETF, with the current version defined in RFC 6376 from 2011. The name describes how it works: a key published in your domain's DNS identifies the mail you send.
How do I find my DKIM selector?
Look at a message you sent. In Gmail, open it and choose Show original, then find the DKIM-Signature header: the value after s= is the selector and d= is the signing domain. Your email service's DKIM settings page also shows it. DNS cannot list selectors, so checkers can only guess common names.
Does DKIM work when email is forwarded?
Usually, yes. A forwarding server that passes the message on unchanged keeps the DKIM signature valid, which is why DKIM keeps DMARC passing when SPF fails after forwarding. It breaks only when the message is modified on the way, for example by a mailing list that adds a footer or changes the subject line.
What DKIM key length should I use?
Use 2048-bit RSA keys. RFC 8301 requires at least 1024 bits and recommends 2048, and 1024-bit keys are now considered weak. A 2048-bit key is longer than one DNS text string allows, so it is split into two strings in one record; most DNS panels and providers handle that for you.
Can a domain have more than one DKIM record?
Yes, one per selector, and most domains need several: one for the mailbox provider, one for the newsletter tool, one for the shop. Each lives at its own selector._domainkey name, so they never conflict. This is different from SPF and DMARC, where a domain may have only one record each.