What Is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to each message using a private key. Receiving servers verify the signature against a public key published in the sender’s DNS, proving the email is authentic and was not altered in transit.
When you send an email, your server signs selected headers and the body with a private key. The matching public key lives in a DNS TXT record at a "selector" subdomain (e.g. "selector1._domainkey.yourdomain.com"). The receiver fetches it, checks the signature, and confirms the message is intact and truly from your domain.
Unlike SPF, DKIM survives most forwarding because the signature travels with the message. This makes it the more robust of the two core mechanisms and a key input to DMARC alignment.
Keys should use at least a 1024-bit (preferably 2048-bit) RSA key, and many senders rotate them periodically for security. A missing or malformed DKIM record is a frequent, silent cause of spam-foldering.
How DKIM works
DKIM uses public-key cryptography. Your sending server holds a private key and, for every outgoing message, computes a signature over selected headers (From, To, Subject, Date, and others) plus the body. That signature is inserted into the message as a DKIM-Signature header, which also names the signing domain (d=) and the selector (s=) used.
The matching public key is published in your DNS as a TXT record at a "selector" subdomain — for example selector1._domainkey.yourdomain.com. When the message arrives, the receiver reads the d= and s= tags, fetches the public key from that exact location, and verifies the signature. If it validates, the receiver knows the message is authentic and its signed content was not altered in transit.
Because the signature travels inside the message, DKIM survives most forwarding — unlike SPF, which breaks when the connecting IP changes. This makes DKIM the more robust of the two core mechanisms and a critical input to DMARC alignment, where the DKIM d= domain must match the visible From domain.
How to set up DKIM
Your email provider or ESP generates the key pair and gives you a selector plus a public key to publish. You add a DNS TXT record at "{selector}._domainkey.yourdomain.com" containing v=DKIM1; k=rsa; p={public key}. The provider keeps the private key and signs on your behalf. Some providers (like Google Workspace) hand you a CNAME instead, pointing to a key they host and rotate for you.
Use at least a 2048-bit RSA key where your provider supports it — 1024-bit is the minimum still accepted but is increasingly considered weak. Because a 2048-bit key exceeds the 255-character limit of a single DNS string, it is split into quoted chunks inside one TXT record, which your DNS host reassembles automatically.
Key rotation and common mistakes
Rotate DKIM keys periodically (many senders do so every 6–12 months) by publishing a new selector, switching signing to it, and retiring the old one after mail signed with it has cleared. Using distinct selectors makes rotation seamless and lets different services sign for the same domain independently.
The most common failures are silent: a missing or malformed public key, a truncated 2048-bit record that was pasted without its second chunk, a selector mismatch between what the server signs with and what is published, and a key left too short. Any of these causes DKIM to fail verification, which weakens DMARC and often lands mail in spam without any obvious error.
Example records
selector1._domainkey.yourdomain.com IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA v3f8Xz2c...your-2048-bit-public-key...QIDAQAB"
Published at the selector subdomain your provider specifies. The p= value is your public key; a 2048-bit key is split across quoted strings inside the single TXT record. The private key never leaves your sending server.
Frequently asked questions
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to each message using a private key. Receiving servers verify the signature against a public key published in your DNS, proving the email is authentic and its signed content was not altered in transit.
What is a DKIM selector?
A selector is a label that tells receivers where to find the correct DKIM public key. It appears in the DKIM-Signature header (s=) and forms the DNS location {selector}._domainkey.yourdomain.com. Selectors let you publish multiple keys — for different services or for rotation — under one domain.
How long does DKIM take to work?
Once you publish the DKIM TXT or CNAME record, DNS propagation typically takes a few minutes to 24–48 hours. After the record resolves, your provider begins signing and receivers can verify immediately. There is no warm-up period — DKIM either validates or it does not as soon as the key is live.
What key length should DKIM use?
Use a 2048-bit RSA key wherever your provider supports it. 1024-bit is the minimum still widely accepted but is considered weak and is being phased out. A 2048-bit public key is longer than a single DNS string allows, so it is split into quoted chunks within one TXT record.
Does DKIM survive email forwarding?
Usually, yes. Because the DKIM signature travels inside the message headers, it remains valid when mail is forwarded — unlike SPF, which breaks because the connecting IP changes. Forwarding only breaks DKIM if an intermediary modifies the signed headers or body.
MailPilot’s free DKIM generator helps you create and format the correct DNS record, and the DNS health checker confirms your signature validates.
Generate your DKIM record →