What is a DKIM record?

A DKIM record is a DNS TXT record that lets receiving mail servers verify that an email was authorized by the domain it claims to come from and was not altered in transit. DKIM, short for DomainKeys Identified Mail, works by adding a cryptographic signature to outgoing messages and publishing the matching public key in DNS.

When DKIM is configured correctly, it supports stronger email authentication, improves trust with mailbox providers, and helps protect a domain from spoofing and phishing abuse. It is also a major part of modern deliverability because providers use DKIM signals alongside SPF, DMARC, reputation, and engagement to decide whether messages reach the inbox.

#	Preview	Product	Price
1		1000 Record Covers	$15.54	Buy on Amazon
2		WP28 - Music Teacher's Record Book – Bastien	$5.50	Buy on Amazon
3		NATIONAL Brand Record Book, Green Canvas, 12.125 x 7.625", 150 Pages (A66150R)	$19.55	Buy on Amazon
4		Off The Record	$31.48	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Understanding a DKIM record means knowing how its selector, public key, and tags fit together, how signing and verification happen, and how to spot common DNS or configuration problems. With the right setup and regular checks, DKIM becomes a practical safeguard for both email performance and domain protection.

What a DKIM Record Is

A DKIM record is a DNS TXT record that publishes a public cryptographic key for a domain. DKIM stands for DomainKeys Identified Mail, an email authentication method that lets receiving mail servers check whether a message was authorized by the domain it claims to represent and whether key parts of the message were changed after sending.

#1 Best Overall

Sale

1000 Record Covers

• Height: 7.75in / 20cm, Width: 6in / 15cm
• By Michael Ochs
• Hardcover
• 576 pages
• Imprint: Taschen

$15.54

Buy on Amazon

In practice, DKIM connects three things: the sending domain, a private key used by the mail system to sign outgoing messages, and a public key stored in DNS. When an email is sent, the sending platform adds a DKIM-Signature header to the message. That signature is generated with the private key. The receiving server then looks up the matching DKIM record in DNS, retrieves the public key, and uses it to verify the signature.

A DKIM record does not usually appear at the root of a domain. Instead, it is published under a selector, which is a label used to identify which DKIM key should be used. For example, a DKIM TXT record might be placed at a DNS name like selector1._domainkey.example.com. The selector allows a domain to use different keys for different email services, rotate keys safely, and separate mail streams such as marketing, transactional, and corporate email.

The value of the DKIM TXT record contains tags that describe the key and how it should be used. A typical record includes a version tag, a key type, and the public key itself. For example, it may contain v=DKIM1, k=rsa, and p= followed by a long public key string. Some providers generate this value automatically, while others require administrators to copy it into the domain’s DNS zone manually.

DKIM is not the same as SPF or DMARC, although they are often used together. SPF checks whether a sending server is allowed to send mail for a domain. DKIM verifies that a message carries a valid cryptographic signature tied to the domain. DMARC builds on SPF and DKIM by telling receivers how to handle messages that fail authentication and by enabling domain owners to receive reports. Together, these controls make it harder for attackers to spoof trusted domains and easier for legitimate mail to be recognized.

How DKIM Email Authentication Works

DKIM authentication connects an outgoing email message to a cryptographic signature published by the sending domain. When a mail server sends a signed message, it adds a DKIM-Signature header to the email. That header contains details such as the signing domain, the selector, the hashing algorithm, the list of signed headers, and the signature value itself. The receiving mail server then uses those details to find the sender’s public key in DNS and verify that the message has not been altered in transit.

The process starts when an organization enables DKIM on its sending mail system, such as Google Workspace, Microsoft 365, Amazon SES, Mailchimp, SendGrid, or another email service provider. The sending platform creates a private key and a matching public key. The private key stays on the sending platform and is used to sign outgoing messages. The public key is published in the domain’s DNS as a TXT record, usually at a hostname that includes a selector, such as selector1._domainkey.example.com.

DKIM signing flow

1. The sender composes and sends an email. The message passes through the authorized sending mail server or email service provider.
2. The sending server selects message parts to sign. DKIM commonly signs headers such as From, To, Subject, Date, and Message-ID, along with a hash of the message body.
3. The server creates a cryptographic hash. The selected headers and body content are transformed into a fixed-length value. Even a small change to signed content creates a different hash.
4. The private key signs the hash. The resulting signature is inserted into the email as the DKIM-Signature header.
5. The email is delivered to the recipient’s mail server. The DKIM signature travels with the message as part of its headers.

When the recipient’s mail server receives the email, it reads the DKIM-Signature header and looks for two fields in particular: d=, which identifies the signing domain, and s=, which identifies the selector. Together, these values tell the receiver where to query DNS. For example, if the signature contains d=example.com and s=selector1, the receiving server checks the TXT record at selector1._domainkey.example.com.

DKIM verification flow

• DNS lookup: The receiver retrieves the DKIM public key from the sender’s DNS TXT record.
• Signature validation: The receiver uses the public key to test whether the DKIM signature was created by the matching private key.
• Content integrity check: The receiver recalculates the hash of the signed headers and body to confirm that protected parts of the message still match.
• Authentication result: The message receives a DKIM result such as pass, fail, neutral, or temperror, which can be used by spam filters and DMARC checks.

A DKIM pass means the message was signed by a server with access to the domain’s private key and that the signed content survived delivery without unauthorized modification. A DKIM fail can happen if the DNS record is missing, the selector is wrong, the public key is malformed, the message was modified by a forwarding service, or the sending platform is using a different key than the one published in DNS. DKIM does not encrypt the message or prove that the visible sender is trustworthy by itself, but it gives receiving systems a reliable way to confirm that a domain-backed signature is valid.

Rank #2

WP28 - Music Teacher's Record Book – Bastien

$5.50

Buy on Amazon

Anatomy of a DKIM DNS TXT Record

A DKIM record is published as a DNS TXT record at a hostname built from a selector and the sending domain. The usual format is selector._domainkey.example.com. The selector lets a domain publish more than one DKIM key at the same time, which is useful when different platforms send mail for the same domain or when rotating keys without interrupting authentication.

The TXT record value contains semicolon-separated tag-value pairs. At minimum, most DKIM records include the version, key type, and public key. A typical record looks like this:

selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

The most common tags in a DKIM DNS TXT record are:

• v=DKIM1: Identifies the record as a DKIM record. This should appear first when used.
• k=rsa: Defines the key type. RSA is still widely used, though some providers support Ed25519.
• p=: Contains the Base64-encoded public key. This is the main part used by receiving mail servers to verify the DKIM signature.
• t=: Sets flags, such as t=s to restrict use to the exact domain or t=y to mark the record as being in testing mode.
• h=: Lists acceptable hash algorithms, such as sha256. This tag is optional and not commonly needed in basic setups.
• n=: Provides optional notes for administrators. Receivers ignore this for verification.

The p tag is the part most likely to cause setup problems because DKIM public keys are long. DNS providers may split long TXT values into mulle quoted strings, but they must still resolve as one continuous value. Extra spaces, missing characters, smart quotes, or line breaks inserted incorrectly can make the record unusable. For RSA keys, 1024-bit keys are now considered weak by many operators; 2048-bit keys are preferred where the DNS host supports the length.

The selector in the DNS name must match the selector in the email’s DKIM-Signature header. For example, if a message contains s=selector1; d=example.com, the receiving server looks up selector1._domainkey.example.com. If the record exists and the public key matches the private key used to sign the message, the server can validate that the signed headers and body content have not been altered since sending.

Some email platforms provide a CNAME record instead of a raw TXT record. In that setup, the selector hostname points to a DKIM record hosted by the provider. This allows the provider to manage key rotation automatically while the domain owner only maintains the DNS pointer. Whether published directly as TXT or delegated through CNAME, the record must be visible in public DNS for DKIM verification to work.

Why DKIM Matters for Deliverability and Security

DKIM matters because it gives receiving mail servers a cryptographic way to confirm that a message claiming to come from your domain was authorized by your domain and was not altered in transit. When a DKIM signature passes, mailbox providers such as Gmail, Outlook, Yahoo, and corporate mail gateways gain a stronger signal that the message is legitimate. That trust can directly affect whether a message reaches the inbox, lands in spam, or is rejected during filtering.

For deliverability, DKIM is one of the core authentication signals evaluated alongside SPF and DMARC. A valid DKIM signature helps build and preserve domain reputation over time, especially for organizations that send marketing campaigns, transactional notifications, invoices, password resets, or customer support messages. Without DKIM, legitimate mail may look less trustworthy because the receiver has fewer technical assurances that the message is connected to the sending domain. This is especially risky when sending through third-party platforms such as email service providers, CRM systems, help desks, billing tools, or ecommerce platforms.

Rank #3

NATIONAL Brand Record Book, Green Canvas, 12.125 x 7.625", 150 Pages (A66150R)

• package height : 1.27 cm
• package length : 30.734 cm
• package width :19.05 cm
• Product type:PAPER PRODUCT
• Index sheet and self-adhesive tabs

$19.55

Buy on Amazon

Deliverability benefits of DKIM

• Improves authentication signals: DKIM helps receivers verify that the sending domain authorized the message.
• Supports domain reputation: Positive engagement and low complaint rates can be associated with an authenticated domain.
• Reduces spam placement risk: Messages with passing DKIM are less likely to be treated as anonymous or suspicious.
• Enables DMARC alignment: DKIM can satisfy DMARC when the signing domain aligns with the domain in the visible From address.
• Works across forwarding: DKIM often survives email forwarding better than SPF because the signature travels with the message.

From a security perspective, DKIM helps protect recipients from forged or tampered messages that appear to come from your domain. A cybercriminal can copy your logo, imitate your writing style, and spoof the visible From name, but they cannot create a valid DKIM signature for your domain unless they control the private signing key or your sending infrastructure. If a message is modified after signing, such as by changing payment details, replacing links, or altering attachments referenced in signed headers, the DKIM check can fail and give the receiving system a reason to distrust the message.

DKIM is also a foundation for stronger domain protection when paired with DMARC. DMARC tells receivers what to do when messages fail authentication, such as quarantine or reject them. DKIM provides one of the authenticated identity checks DMARC can use to determine whether a message is legitimate. For example, if an attacker sends mail using your domain in the From address but cannot produce an aligned DKIM signature, a properly configured DMARC policy can help prevent that message from reaching recipients.

Security risks DKIM helps reduce

• Domain spoofing: Attackers impersonate your domain to trick customers, employees, or partners.
• Phishing campaigns: Fraudulent messages use brand trust to steal credentials or payment information.
• Message tampering: Content changes after sending can break the DKIM signature.
• Brand damage: Repeated abuse of an unauthenticated domain can harm customer trust and sender reputation.

DKIM is not a complete security solution by itself. It does not encrypt the message body for privacy, it does not prove that the sender is honest, and it does not stop every phishing attempt. Its value is in proving domain-authorized signing and message integrity, which makes it much harder for unauthorized senders to impersonate your domain successfully. For modern email programs, DKIM is no longer optional infrastructure; it is a basic requirement for reliable delivery, abuse prevention, and long-term protection of a domain’s reputation.

How to Create and Publish a DKIM Record

Creating a DKIM record usually starts in the email platform that sends mail for your domain, such as Google Workspace, Microsoft 365, Amazon SES, Mailchimp, SendGrid, HubSpot, or another CRM or marketing service. The provider generates a DKIM key pair: a private key kept on its mail servers and a public key that you publish in DNS. When outbound messages are sent, the provider signs selected headers and body content with the private key. Receiving mail servers then retrieve the public key from your DNS to verify that the signature matches.

The first step is to enable DKIM signing in the sending service’s admin area. Look for settings named DKIM authentication, domain authentication, email authentication, or sender authentication. After you choose the domain, the service will provide one or more DNS records. Most DKIM records are published as TXT records, although some providers use CNAME records that point to DKIM records they host and rotate for you.

1. Choose the sending domain. Use the domain that appears in the visible From address, such as example.com, or a subdomain such as mail.example.com.
2. Generate the DKIM record. In your email provider, create a DKIM key. Select a modern key length if offered, commonly 2048-bit.
3. Copy the selector and value. The selector is the label before ._domainkey, such as selector1, google, or s1. The TXT value contains tags such as v=DKIM1, k=rsa, and p= followed by the public key.
4. Add the record in DNS. Open your DNS host, create a TXT record, and enter the host name in the format selector._domainkey. For example, selector1._domainkey.example.com.
5. Save and wait for propagation. DNS changes often appear within minutes, but some environments can take several hours depending on TTL values and resolver caching.
6. Return to the email provider and verify. Most platforms include a button to check the DNS record and activate DKIM signing once the public key is visible.

A typical DKIM TXT record name might be selector1._domainkey.example.com. Its value might begin with v=DKIM1; k=rsa; p= followed by a long public key. When entering the value, paste it exactly as provided by the sender. Some DNS interfaces automatically append the domain name, so entering the full host can accidentally create a record like selector1._domainkey.example.com.example.com. If your DNS host has separate fields for Name and Value, the name field often needs only selector1._domainkey.

If your organization uses mulle email services, each service may need its own DKIM selector. For example, Microsoft 365 might use selector1 and selector2, while a marketing platform uses s1 and s2. These records can coexist because the selector makes each DNS name unique. After publishing, send a test message to an external mailbox and inspect the message headers for a result such as dkim=pass. Once DKIM is passing consistently, align it with SPF and DMARC so mailbox providers can connect authentication results to your domain policy.

How to Check and Troubleshoot DKIM Records

After publishing a DKIM record, verify that DNS is returning the correct TXT value and that your outgoing messages are being signed with the matching private key. DKIM issues are often caused by small formatting errors, the wrong selector, DNS propagation delays, or a mismatch between the domain used in the signature and the domain where the public key is published.

Rank #4

Off The Record

$31.48

Buy on Amazon

Check the DKIM record in DNS

Start by identifying the DKIM selector used by your email platform. The selector appears in the s= tag of a DKIM signature header, and the signing domain appears in the d= tag. Together, they form the lookup name: selector._domainkey.example.com. For example, if the selector is google and the domain is example.com, check google._domainkey.example.com.

• Use a DNS lookup tool to query the TXT record for the selector hostname.
• Confirm the record begins with v=DKIM1 and includes p= followed by the public key.
• Make sure the record is published as a TXT record, not an A, CNAME, or SPF-style entry unless your provider specifically uses a CNAME-based DKIM setup.
• Check that the TXT value is not split incorrectly, truncated, or surrounded by extra characters copied from documentation.

Send a test message and inspect the headers

Send an email from the domain to a mailbox where you can view the full message headers, such as Gmail, Outlook, or a dedicated deliverability testing tool. Look for the DKIM-Signature header and an authentication result such as dkim=pass or dkim=fail. A passing result means the receiving server found the public key in DNS and confirmed that signed parts of the message were not changed in transit.

Common DKIM troubleshooting steps

1. Wait for DNS propagation. New or edited records may take time to appear globally, depending on the DNS provider and TTL.
2. Check for duplicate records. A selector should normally return one valid DKIM TXT record. Multiple conflicting TXT records can cause verification failures.
3. Verify the signing domain. The domain in d= must match the location of the published public key, and it should align with the visible From domain for DMARC to pass through DKIM.
4. Confirm key length support. Many providers use 2048-bit keys. Some older DNS interfaces mishandle long TXT records, so use the exact format recommended by your provider.
5. Retest after every change. Send a fresh message because older test emails were signed before the DNS or platform update.

If DKIM still fails, compare the selector, domain, and public key shown in your email service with what DNS returns publicly. Most failures come down to a mismatch between those three items. Once the DNS record and outgoing signature match, DKIM should pass consistently for mail sent through the authorized platform.

Frequently Asked Questions

How do I know what my DKIM record should be?

Your email provider usually generates the DKIM selector and public key for you, so start in the admin settings for Google Workspace, Microsoft 365, Mailchimp, SendGrid, or your other sending service. The value is typically published as a DNS TXT record at a host name like selector._domainkey.example.com. Do not create your own key unless you manage the mail server or signing software yourself.

Can I have more than one DKIM record for the same domain?

Yes, a domain can have mulle DKIM records as long as each one uses a different selector. This is common when you send mail through several platforms, such as Microsoft 365 for employee email and a marketing platform for newsletters. Each service should sign with its own private key and publish a matching public key under its own selector.

How long does it take for a new DKIM record to start working?

After you publish the DKIM TXT record, DNS propagation can take a few minutes to several hours depending on your DNS provider and the record’s TTL. Many email platforms will not verify the record instantly, so wait a short time and then use the provider’s check button or a DKIM lookup tool. If it still fails after 24 hours, check the selector, host name, TXT value formatting, and whether the record was added to the correct DNS zone.

What does it mean if DKIM fails but SPF passes?

It means the sending server may be authorized by SPF, but the message’s DKIM signature could not be verified against the public key in DNS. Common causes include a missing or incorrect DKIM record, the wrong selector, message modification after signing, or a mismatch between the signing domain and the visible From domain. If you use DMARC, DKIM must also align with the From domain to count as a DMARC pass.

Do I need DKIM if I already have SPF and DMARC?

Yes, DKIM is still strongly recommended because it verifies that signed parts of the email were not altered and gives DMARC another way to authenticate the message. SPF can fail when mail is forwarded, while DKIM often survives forwarding if the message content is not changed. Using SPF, DKIM, and DMARC together gives better deliverability and stronger protection against domain spoofing.

Bottom Line

A DKIM record is a small DNS TXT record that plays a big role in proving your emails are genuinely from your domain and have not been altered in transit. When paired with proper signing, alignment, and authentication checks, it helps improve deliverability and reduces the risk of spoofing and phishing abuse.

If you manage a sending domain, publish the DKIM record provided by your email service, verify it with a lookup tool, and monitor failures alongside SPF and DMARC. Keeping DKIM configured correctly is one of the simplest ways to protect your domain reputation and help legitimate messages reach the inbox.

Quick Recap

SaleBestseller No. 1

1000 Record Covers

Height: 7.75in / 20cm, Width: 6in / 15cm; By Michael Ochs; Hardcover; 576 pages; Imprint: Taschen

$15.54

Bestseller No. 2

WP28 - Music Teacher's Record Book – Bastien

$5.50

Bestseller No. 3

NATIONAL Brand Record Book, Green Canvas, 12.125 x 7.625", 150 Pages (A66150R)

package height : 1.27 cm; package length : 30.734 cm; package width :19.05 cm; Product type:PAPER PRODUCT

$19.55

Bestseller No. 4

Off The Record

$31.48

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.