Guide

What DKIM is and how to set it up

How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.

DKIM (DomainKeys Identified Mail, RFC 6376) lets a receiver verify that a message was sent by someone authorised by a domain and was not modified in transit. It is the most reliable way to pass DMARC.

How it works

  1. Your sending service holds a private key. When it sends a message, it hashes selected headers and the body and signs the result, adding a DKIM-Signature: header.
  2. The header names the signing domain (d=) and a selector (s=).
  3. The receiver looks up the public key at <selector>._domainkey.<domain> and checks the signature.
google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

Selectors

A selector is just a name that lets a domain publish several keys at once: one per sending service, or an old and a new key during rotation. That is also why DKIM cannot be checked from a domain name alone, the way SPF and DMARC can: you need the selector, which appears in the DKIM-Signature: header of a message you received.

Setting it up

For each service that sends as your domain:

  1. Find its DKIM or "domain authentication" setting. Google Workspace, Microsoft 365 and every serious bulk-mail tool have one.
  2. Add the DNS records it gives you, usually a TXT or CNAME at a _domainkey name.
  3. Switch signing on, then send a test message and check its headers for dkim=pass with header.d= your domain.

Use 2048-bit RSA keys where the service offers them; 1024-bit keys are considered weak. Rotate keys occasionally by publishing a new selector before retiring the old one.

DKIM and DMARC

DMARC passes when DKIM passes for a domain aligned with the From: address. If a service signs with its own domain (d=sendgrid.net) rather than yours, the signature is valid but does not help your DMARC. Setting up DKIM "for your domain" in the service is what fixes that.

Check your DKIM keys

More guides

  • SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.
  • How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
  • Fixing "SPF PermError: too many DNS lookups" Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.
  • Moving DMARC from p=none to p=reject A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.
  • How to secure a domain that sends no email Parked and website-only domains are easy targets for spoofing. Three DNS records — null MX, a deny-all SPF record and DMARC reject — lock them down.
  • DMARCbis: what changed in DMARC in 2026 (RFC 9989) DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.
  • DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.
  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.