How to turn on DKIM signing for your domain
DKIM signs every message so receivers can check it came from you unchanged. Your email provider generates the key; you publish it in DNS.
Step by step, with screenshots: What is DKIM? Signatures, selectors and the DKIM record →
Check your own domain
Our DMARC checker (email & DNS) tool runs this check and writes the record to add, free, in seconds.
What it is
DKIM (DomainKeys Identified Mail) adds a digital signature to every email your domain sends. Your mail provider signs each message with a private key, and receiving servers check the signature against a public key you publish in DNS, which proves the message came from your domain and was not changed on the way.
DKIM matters most as one half of DMARC: unlike SPF, a DKIM signature usually survives forwarding. Gmail and Yahoo require SPF or DKIM from all senders, and both from bulk senders. getReport looks for a DKIM public key under common selectors; selectors are chosen by each provider, so "not found" can also mean yours uses a name the check does not try. Your domain is OK when every service that sends as you signs with a DKIM key on your domain.
What a passing site looks like
- DKIM key: passesinfo onlyeffort M
DKIM key
Why it matters. DKIM signs every message so receivers can check it really came from you and was not changed. DKIM also keeps forwarded mail passing DMARC, which SPF alone cannot.
- Turn on DKIM signing in your email provider (Google Workspace, Microsoft 365, your newsletter tool) and publish the key record it gives you.
- DKIM keys live under a selector only your provider knows; if yours is set up, this check may simply not guess its name.
Questions people ask
What is a DKIM record?
It is a TXT record, or sometimes a CNAME pointing to your provider, published at selector._domainkey.yourdomain. Its value holds the public key, for example v=DKIM1; k=rsa; p= followed by a long string of characters. Your email provider generates the key pair and tells you the exact name and value; you only copy them into your DNS.
What is a DKIM selector?
A selector is the label that tells receivers which DKIM key to look up, so one domain can have several keys for different services or key rotations. It appears as s= in the message's DKIM-Signature header and as the first part of the DNS name, such as google._domainkey.example.com. Google Workspace uses google by default; Microsoft 365 uses selector1 and selector2.
What is a DKIM signature?
It is the DKIM-Signature header your mail server adds to each outgoing message. It contains a cryptographic hash of the body and selected headers, signed with your private key, plus the signing domain (d=) and the selector (s=). You can see it by choosing Show original in Gmail, which also shows whether DKIM passed.
Should I rotate DKIM keys?
Yes, periodically. Rotating every 6 to 12 months limits the damage if a private key leaks, and it is a good moment to move from 1024-bit to 2048-bit keys. Most providers rotate for you when you publish their keys as CNAME records; with TXT records, add the new selector, switch signing to it, then remove the old key after a few days.
What is the difference between SPF and DKIM?
SPF checks which server sent the message, using a list of allowed servers in your DNS. DKIM checks the message itself, using a signature that proves it came from your domain unchanged. SPF breaks when mail is forwarded, while DKIM usually survives. DMARC builds on both, so set up both for every service that sends as you.