DKIM, DomainKeys Identified Mail, puts a signature in each message's headers. The sending service signs with a private key it holds. The receiver fetches the matching public key from your DNS and checks the signature. A pass proves which domain signed the message and that the signed parts arrived unchanged.
Does DKIM encrypt my email? No. It signs it. Anyone on the path can read the message. What they can't do is change the signed headers or the body without the signature failing.
If you're here to turn it on, jump to setting up DKIM. If a message failed, our DKIM fail guide works from the failing message's headers.
The check needs a key from your DNS
When the sending service signs a message, it takes a hash of the body and a hash of a chosen set of headers, and signs both with its private key. The result goes into a DKIM-Signature header along with the signing domain and a selector.
The receiver reads that header, builds a DNS name from the selector and the domain, and fetches a TXT record there. The record holds the public key. The receiver recomputes both hashes from the message it received and checks them against the signature. If everything matches, dkim=pass goes into Authentication-Results.
RFC 6376 defines all of it. The From header must be among the signed headers, so a pass ties the signature to the address the reader sees.
The selector picks the key
The DNS name is built from the s= and d= tags in the signature: the selector, then ._domainkey., then the domain.
Selectors exist so a domain can publish more than one key at the same time. Each service that signs for you gets its own selector and its own key, so the helpdesk's key can be replaced without touching staff mail. Rotation works the same way: publish the next key under a fresh selector, switch signing to it, and remove the old one once mail signed with it has stopped arriving.
Google Workspace uses the selector google by default. Microsoft 365 uses selector1 and selector2, one active and one waiting for the next rotation. Every other platform documents its own, and many hand you a CNAME that points at a key they host.
Don't guess a selector. Send yourself a message from the service and read s= from the real signature. Our DKIM checker then fetches the record for that selector and domain and shows what a receiver sees.
The DNS record holds the public key
A DKIM record is a TXT record at the selector's name. Its value is a list of tags:
v=DKIM1 marks the version. k=rsa is the key type. p= is the public key itself, a long string of base64. An empty p= means the key was revoked, and mail signed with it fails from that point on.
Two optional flags matter. t=y marks the key as being in test mode, and receivers then treat a message it signed no differently from an unsigned one. t=s says the key may only sign for the exact domain and not for subdomains. Leave both out unless your platform tells you to set them.
A long key often arrives as several quoted strings in one TXT record. Receivers join them without spaces. Paste it exactly as your platform gives it, and check the whole value after publishing. A key cut short by a DNS panel's length limit is the most common reason a fresh setup fails.
RFC 8301 requires RSA keys of at least 1024 bits and recommends 2048. Google offers both sizes and recommends 2048 where your DNS host supports it. Microsoft's PowerShell setup defaults to 1024 with 2048 as an option.
Reading a DKIM-Signature header
| Tag | What it holds |
|---|---|
d= | The signing domain. This is the domain DMARC compares with the From address. |
s= | The selector. Combine with d= to find the key. |
a= | The algorithm, normally rsa-sha256. rsa-sha1 is obsolete and receivers may reject it. |
h= | The headers that were signed, in order. From is always among them. |
bh= | The hash of the body at signing time. |
b= | The signature itself. |
c= | How whitespace is treated before hashing. relaxed/relaxed tolerates small changes in spacing. |
t= and x= | When the signature was made and when it expires. |
A message can carry more than one signature. A marketing platform often adds its own under its domain alongside one under yours. Read each d=, because only the one matching your From domain counts for DMARC.
DKIM survives a forward, until something edits the message
SPF fails whenever a forwarder delivers your mail from its own server. DKIM doesn't care which server delivered the message, only whether the signed parts are intact. That's why DKIM carries DMARC through forwarding and mailing lists, and why it's the check to get right first.
The exception is anything that changes the body or a signed header after signing. A footer added by a gateway, a rewritten link, a mailing list tagging the subject: each one breaks the body hash or the header hash. Our body hash guide works through finding the culprit.
For DMARC, the signing domain has to match the From domain. A platform that signs only with its own domain gives you a passing signature that doesn't align. Enable custom-domain signing at the platform so d= is your domain. Our alignment guide covers the relaxed and strict forms.
Set up DKIM at each sending service
DKIM is configured per service, not per domain. Signing your staff mail does nothing for the invoice app. Work through each platform that sends as your domain.
Google Workspace. In the Admin console, open Apps > Google Workspace > Gmail > Authenticate email, choose the domain and generate a key. Keep the google prefix and pick 2048 bits if your DNS host accepts a value that long. Publish the TXT record at google._domainkey, then return and click Start authentication. Google's DKIM setup page says it can take up to 48 hours to start working.
Microsoft 365. In the Defender portal, open Email authentication settings > DKIM and select the domain. Microsoft gives you two CNAME records, at selector1._domainkey and selector2._domainkey, each pointing at a target specific to your tenant. Publish both, then enable signing. Only one selector is active at a time and the other is held for rotation. Microsoft's DKIM setup page has the exact target format.
Every other platform. Look for domain authentication or sender authentication in the platform's settings. Most give you a CNAME or a TXT record and a button to verify it. Our provider pages cover each one, including where the signing setting lives and what it takes to sign with your domain.
After each one, send a test to a mailbox outside your company and read Authentication-Results. You want dkim=pass with header.d= showing your domain. Repeat from the platform itself, not from your own mailbox.
Keys change, and the record has to follow
Platforms rotate keys. A CNAME follows the rotation for you, and a pasted TXT key doesn't. When a platform retires a key you pasted by hand, its mail starts failing DKIM, and DMARC then rests on SPF, which a forward breaks.
On a paid plan we email you when a source first fails DMARC. A retired key then shows up the day its reports arrive, rather than when a customer asks why the invoice went to spam. The weekly digest shows the reported results by source. Your first domain is free.
Read the key a selector publishes for your domain
The record as receivers fetch it, with the key length and the faults marked.
Free · No signup · The result names what to change
Questions
What does DKIM stand for?
DomainKeys Identified Mail. The sending service signs each message with a private key, and the receiver checks the signature against a public key published in your DNS. RFC 6376 defines it.
What is a DKIM selector?
A name that picks which public key to fetch. The receiver reads it from the s= tag in the signature and looks up selector._domainkey.yourdomain in DNS. Selectors let a domain publish several keys at once, one per service or for rotation.
Does DKIM encrypt email?
No. The message travels in the clear. DKIM signs it, so a receiver can prove which domain signed it and that the signed headers and body didn't change in transit.
How do I find my DKIM selector?
Send yourself a message from the service and read the DKIM-Signature header. The s= tag is the selector and d= is the signing domain. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2.
Keep reading
Checking as you go? The DMARC checker reads the policy you are moving up, the SPF and DKIM checkers show whether your senders will survive it, and the report analyzer reads an aggregate report you already have. No signup.
DomainCanary is a DMARC enforcement service that protects your domain from email spoofing without blocking your own mail.