What is DKIM? DomainKeys Identified Mail Explained

How DKIM Works

Your mail server signs each outgoing message with a private key. The signature is added as a DKIM-Signature header. The receiving server looks up your domain's public key in DNS (published as a TXT record) and verifies the signature matches.

1. Your mail server generates a public/private key pair
2. The public key is published as a TXT record at a selector, e.g. selector1._domainkey.yourdomain.com
3. Every outgoing email is signed with the private key, adding a DKIM-Signature header
4. The receiving server fetches your public key from DNS using the selector named in the header
5. It recalculates the signature and compares — a match means the email is authentic and unmodified

DKIM DNS Record

The record lives at a selector-specific hostname, not the domain root:

selector1._domainkey.yourdomain.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGS..."

DKIM Record Tags

What Is a "Selector"?

The selector lets a domain publish multiple DKIM keys at once — useful when rotating keys or using several mail providers. Each provider tells you which selector to use (common examples: google, selector1, k1, mandrill).

Setting Up DKIM

1. Enable DKIM signing in your email provider (Google Workspace, Microsoft 365, SendGrid, etc.) — they generate the key pair for you
2. Copy the TXT record and selector hostname they give you
3. Add the TXT record to your DNS
4. Wait for propagation, then verify with the provider or a DKIM lookup

Why You Need SPF, DKIM and DMARC Together

Each covers a different gap:

• SPF authorizes which servers may send — but breaks when email is forwarded
• DKIM proves the message content was not tampered with — survives forwarding, but does not by itself say who is authorized to send
• DMARC ties the two together and tells receivers what to do when both fail, plus gives you visibility via reports

Common Problems

• Signature breaks after forwarding by mailing lists — some list software rewrites the body/subject, invalidating the signature. This is expected and is exactly why DMARC alignment allows SPF OR DKIM to pass, not both.
• Key too long for a single TXT string — 2048-bit keys often need to be split across multiple quoted strings in the same TXT record; most DNS providers handle this automatically.
• Wrong selector — if the selector in your DNS doesn't match what your mail provider signs with, verification fails silently.

Check Your DKIM Setup

Use the Email Security checker to verify SPF, DKIM and DMARC together: