What Is DKIM? How Email Signing Works
Also known as DomainKeys Identified Mail, DKIM signature, DKIM record
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to each outgoing message. The sending server signs selected headers and the body with a private key, and receivers verify the signature using a public key published in DNS. A valid signature proves the domain sent the email and that it was not altered.
DKIM explained
The public key lives in a TXT record at selector._domainkey.yourdomain.com. The selector is a label chosen by the sender or provider, such as google for Google Workspace, so one domain can hold several keys for different services. Each signed email carries a DKIM-Signature header with the signing domain (d=) and the selector (s=), which tells the receiver exactly where to find the key.
DKIM survives forwarding better than SPF, because the signature travels with the message rather than depending on the sending IP. That makes it the more reliable path to passing DMARC. For DMARC alignment, the d= domain in the signature must match the visible From domain, or share its organizational domain under relaxed alignment.
Gmail and Yahoo require bulk senders to sign with DKIM, and every serious cold email setup turns it on for each sending domain. Use 2048-bit keys where your DNS host supports them, and check that every third-party tool sending as your domain signs with your domain, not its own default.
DKIM example
Acme Inc enables DKIM in Google Workspace for tryacme.com. Google generates a 2048-bit key and shows a TXT record for google._domainkey.tryacme.com. After publishing it and clicking Start authentication, test emails show dkim=pass with d=tryacme.com in the headers, so DMARC now passes on DKIM alignment even when SPF breaks during forwarding.
Host: google._domainkey.example.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQABHow to set up DKIM
Generate a key in your provider
In Google Workspace, Microsoft 365 or your sending platform, open the DKIM or domain authentication settings and generate a key for the domain, choosing 2048-bit if offered.
Publish the DNS record
Copy the host name (selector._domainkey) and the value exactly, and add it as a TXT or CNAME record, depending on what the provider asks for.
Turn on signing
Return to the provider and activate DKIM signing. Some providers only start signing after they detect the DNS record.
Verify with a test email
Send a message to a Gmail account, open Show original and confirm DKIM shows PASS with your own domain as the signing domain.
Repeat for every sender
Set up DKIM for each tool that sends as your domain, such as your CRM or marketing platform, each with its own selector.
Common mistakes
- Generating the key but never turning on signing in the provider's admin console.
- Pasting the key with extra quotes, spaces or line breaks that break the record.
- Letting third-party tools sign with their own domain, so DKIM passes but does not align for DMARC.
- Using short 1024-bit keys when the provider and DNS host support 2048-bit.
DKIM FAQ
A selector is a label that tells receivers which public key to look up, in the format selector._domainkey.example.com. It lets one domain have several DKIM keys, for example one for Google Workspace and another for a marketing platform. The selector appears in the s= tag of the DKIM-Signature header.
Yes, in practice. Google and Yahoo require both for bulk senders, and having both gives DMARC two ways to pass. DKIM is especially valuable because it survives forwarding, where SPF often fails. Set up both on every sending domain.
Send an email to a Gmail account, open the message menu and choose Show original. Look for DKIM: PASS and check that the signing domain matches your From domain. DKIM lookup tools can also confirm the public key is published correctly for a given selector.
Use 2048-bit keys where possible. They are stronger and widely supported by mailbox providers and most DNS hosts. Some older DNS interfaces have trouble with long TXT values, so split the value into multiple strings if your host requires it.