What is a DKIM record? How to set up and check DKIM

If you send email from your own domain, three DNS records decide whether receivers trust it: SPF, DKIM and DMARC. Of the three, DKIM is the one that travels with every message — a digital signature that proves the email really came from your domain and was not changed along the way.

This guide explains how DKIM works, what a DKIM record looks like, and how to set it up and check it, without the cryptography lecture.

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method. When you send a message, your email service adds a signature to it — a DKIM-Signature header — created with a private key that only the sender has.

The matching public key is published in your domain's DNS as a TXT record. The receiving server reads the signature, looks up the public key, and checks that the two match. If they do, it knows two things:

1. the message was signed by someone authorized to send for the domain in the signature;
2. the signed parts of the message (headers such as From and Subject, and the body) were not altered in transit.

Why DKIM matters

• Inbox placement. Gmail, Outlook and Yahoo weigh authentication heavily. Since 2024, Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM and publish DMARC.
• DMARC needs it. DMARC passes when SPF or DKIM passes and is aligned with your From domain. DKIM is the more robust of the two because it survives forwarding, which often breaks SPF.
• Reputation. A valid signature ties your mail to your domain, so the reputation you build belongs to you.

What a DKIM record looks like

A DKIM record is a TXT record at a special host name:

selector._domainkey.yourdomain.com

Its value looks something like this (shortened):

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6o…

What is a selector?

The selector is simply the name of a key, chosen by your email provider. It lets one domain have many keys: one for your mailbox provider, one for your newsletter tool, one for your app — each at its own host name, with no conflict.

Some examples you may see: google (Google Workspace), selector1 and selector2 (Microsoft 365), k1 (Mailchimp), s1 and s2 (SendGrid). To find the selector used on a real message, open it, view the original source, and look for s= in the DKIM-Signature header. The d= tag next to it shows the signing domain.

1024-bit or 2048-bit keys?

Use 2048-bit keys. They are the current recommendation and supported by every major provider. 1024-bit keys are still widely accepted but considered weaker; keys shorter than 1024 bits are rejected.

One practical catch: a 2048-bit key is longer than the 255-character limit for a single TXT string. Most DNS panels split it automatically; some need you to paste it as several quoted strings. If the key gets cut off, DKIM fails — the most common DKIM setup mistake.

How to set up DKIM

1. Get the record from your email service. In its domain or authentication settings, it will show a host name (with the selector) and a value. Some services give you a CNAME that points to a key they manage; others give you the TXT record directly.
2. Add it in your DNS. Many DNS panels add your domain automatically, so the host is often just selector._domainkey — do not type your domain twice.
3. Wait for DNS to update. Usually minutes, sometimes a few hours.
4. Turn on signing in your email service if it is not automatic, and send a test message.
5. Check it with a DKIM checker and by viewing the original of your test email: look for dkim=pass in the Authentication-Results header.

Common DKIM problems

• Record not found: wrong host name (domain typed twice, or a missing _domainkey), or the wrong selector.
• Invalid key: the p= value was truncated or broken when pasted.
• DKIM passes but DMARC fails: the signature uses the service's domain (d=service.com) instead of yours. Set up DKIM for your own domain in that service so the signature aligns.
• Body hash did not verify: something changed the message after signing — often a mailing list or security gateway adding a footer.

DKIM, SPF and DMARC together

• SPF says which servers may send for your domain. Check SPF.
• DKIM proves each message was signed by your domain and not changed. Check DKIM.
• DMARC tells receivers what to do when both fail, and sends you reports. Check DMARC.

Our overview SPF, DKIM and DMARC explained shows how they fit together, and the Gmail and Yahoo bulk sender requirements explain what is mandatory.

The bottom line

DKIM is a one-time setup that pays off on every email you send. Publish a 2048-bit key from each service that sends for you, make sure the signature uses your own domain, and check it once — then keep an eye on it if you change providers. When you add a custom sending domain in InboxRoads, the DKIM record is generated for you and checked automatically.