Skip to content

What is DKIM?

By Ash, Founder, HosteazePublished 1 min read

The short answer

DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. Your email provider signs each message with a private key, and you publish the matching public key in your domain's DNS. Receiving servers use it to confirm the email came from your domain and wasn't changed on the way.

Brass stamp pressing a red wax seal onto a document, the old-fashioned version of a DKIM signature
Credit: WolfBlur via Pixabay

DKIM works like a wax seal on a letter. Your email provider stamps every outgoing message with a signature only it can make, and anyone can check that seal against the public key in your DNS. If someone forges your address, or a message is altered on the way, the seal doesn't match.

How does DKIM work?

  1. Your email provider creates a pair of keys: a private key it keeps, and a public key for you.
  2. You publish the public key as a DNS record on your domain.
  3. Every email you send gets a DKIM-Signature header, made with the private key.
  4. The receiving server looks up your public key and checks the signature. A match is a DKIM pass.

What does a DKIM record look like?

The record lives at a name made of a selector, _domainkey, and your domain:

google._domainkey.yourdomain.com   TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
PartMeaning
googleThe selector. Each service picks its own (Microsoft 365 uses selector1 and selector2).
v=DKIM1Identifies the record.
k=rsaThe key type.
p=The public key itself, a long string you copy from your provider.

You never write the key yourself. Your provider generates it and shows you the exact name and value to paste. Some, including Microsoft 365, ask for a CNAME record instead of a TXT record so they can rotate the key for you.

Why does DKIM matter more than SPF?

DKIM survives forwarding, and SPF doesn't. When a client forwards your email to their accountant, the forwarding server isn't on your SPF list, but your DKIM signature still checks out. That makes DKIM the more reliable way to pass DMARC. For the steps, see how to set up SPF, DKIM and DMARC.

Frequently asked questions

What is a DKIM selector?

A label that lets one domain have several DKIM keys, one per service. It forms the first part of the record's name, for example google._domainkey.yourdomain.com.

Do I need a DKIM record for each service that sends my email?

Yes, ideally. Each service signs with its own key, so each needs its own DKIM record under a different selector. They don't conflict with each other.

Should I use a 1024-bit or 2048-bit key?

Use 2048-bit if your DNS provider accepts it. Google and Microsoft both support 2048-bit keys.

Sources

  1. RFC 6376, DomainKeys Identified Mail (DKIM) Signatures
  2. Google Workspace, Set up DKIM
  3. Microsoft, How to use DKIM for email in your custom domain

Keep reading

Traffic light showing a red stop signal under a blue bicycle signalQuestionDMARC p=none vs quarantine vs reject, which should I use?p=none tells receivers to deliver failing email as normal and just send you reports. p=quarantine sends failing email to spam. p=reject blocks it completely. Start at none, read the reports until every service you use passes, then move to quarantine and finally reject. Skipping straight to reject can block your own invoices.Email and domains · 12 October 2026Magnifying glass and pen resting on printed spreadsheets, ready to check the detailsQuestionHow do I check if my domain has DMARC?Look up the TXT record at _dmarc.yourdomain.com. The quickest way is the free Google Admin Toolbox Dig tool. Enter _dmarc followed by your domain, choose TXT, and look for a value starting v=DMARC1. If nothing comes back, your domain has no DMARC record and you should add one.Email and domains · 12 October 2026Open red mailbox with a stream of envelopes flying away from it, like email going astrayQuestionWhy are my emails going to spam?The most common reason is missing or broken email authentication. If your domain has no SPF, DKIM or DMARC records, Gmail and Outlook can't prove the email is really from you. After that come a poor sender reputation, a shared server with a bad history, and messages that look like marketing. Check authentication first.Email and domains · 12 October 2026Hands typing on a keyboard as email envelopes fly outTutorialHow to set up SPF, DKIM and DMARC for your business emailAdd three DNS records in this order. First an SPF record listing who can send email for your domain, then a DKIM record your email provider generates, then, about 48 hours later, a DMARC record starting at p=none. Watch the DMARC reports for a few weeks before tightening the policy to quarantine.Email and domains · 11 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans