--- title: "DKIM: What It Is & How It Works | AutoSPF" description: "A complete guide to DKIM (DomainKeys Identified Mail): how it works, the DKIM record, selector and signature, how to set it up, and how it works with SPF and DMARC." image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/dkim/" --- Email Authentication # DKIM DomainKeys Identified Mail — how it signs your email, proves it wasn’t tampered with, and works alongside SPF and DMARC. [Check any domain’s DKIM with the free DKIM Lookup →](/tools/dkim-lookup/) **DKIM (DomainKeys Identified Mail) is an email authentication standard that lets a receiving server confirm a message was genuinely sent by your domain and was not altered in transit.** Your outbound mail server signs each message with a private key, and receivers verify that signature against a matching public key published in your domain’s DNS. DKIM is one of the three pillars of modern email authentication, alongside SPF and DMARC. Together they decide whether your mail reaches the inbox or lands in spam — and whether attackers can spoof your domain. This page explains what DKIM is, how it works, and how each piece fits together. ## How DKIM works DKIM works as a sign-on-send, verify-on-receipt handshake built on public-key cryptography. When your mail server sends a message, it generates a cryptographic hash of selected headers (and usually the body), encrypts that hash with a **private key** that only your server holds, and attaches the result to the email as a `DKIM-Signature` header. The matching **public key** lives in your domain’s DNS as a TXT record. When a receiving server accepts the message, it reads the `DKIM-Signature` header, looks up the public key in DNS, and uses it to verify the signature. If the signature validates, the receiver knows two things: the message really came from a server authorized to sign for your domain, and the signed content was not tampered with along the way. If anything was changed — or the key does not match — DKIM verification fails. Because the private key never leaves your infrastructure, a spoofer cannot forge a valid DKIM signature for your domain. ## The parts of DKIM DKIM is made up of a few coordinated pieces, each with its own detailed guide: - **The [DKIM record](/dkim/dkim-record/)** — the DNS TXT record that publishes your public key and DKIM settings so receivers can find and verify signatures. - **The [DKIM selector](/dkim/dkim-selector/)** — a short label that tells receivers _which_ key to look up, allowing you to run multiple keys (for different providers or key rotations) on one domain. - **The [DKIM signature](/dkim/dkim-signature/)** — the `DKIM-Signature` header stamped onto every outgoing message, containing the signing domain, the selector, and the cryptographic hash itself. Understanding how these three connect makes the rest of DKIM setup and troubleshooting far easier. ## How to set up DKIM Setting up DKIM is a short, repeatable process: 1. **Generate a key pair** in your mail provider’s console — the private key stays with the provider, and you are given the public key to publish. 2. **Publish the public key** as a TXT record in DNS at `selector._domainkey.yourdomain.com`. See [how to generate a DKIM record](/dkim/how-to-generate-a-dkim-record/) for the exact steps. 3. **Enable signing** in your provider so outbound mail is stamped with the DKIM signature. 4. **Verify** that messages are signed and passing before you rely on it. In practice, DKIM keys are generated inside your mail provider’s console — Google Workspace, Microsoft 365, or your ESP — rather than by hand, so most of the work is copying the provided record into DNS. A published DKIM record looks like this: ``` selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqF...GfMA0=; t=s" ``` Here `selector1` is the selector, `v=DKIM1` marks it as a DKIM record, `k=rsa` names the key type, and `p=` carries the base64-encoded public key. ## DKIM, SPF and DMARC together DKIM does not work in isolation. It complements [SPF](/tools/spf-checker/), which authorizes _which servers_ are allowed to send mail for your domain. SPF checks the connecting server’s IP against your published list; DKIM checks the cryptographic signature on the message itself. The two protect different things — sending source versus message integrity — and either one can pass or fail independently. DMARC is the policy layer that ties them to the address recipients actually see. DMARC requires that a passing SPF or DKIM result **aligns** with the visible `From:` domain, then tells receivers what to do when neither aligns — deliver, quarantine, or reject. This alignment is what stops attackers from passing authentication on a domain they control while spoofing yours in the From line. | Standard | What it verifies | | -------- | --------------------------------------------------------------------- | | SPF | Which servers may send for your domain | | DKIM | The message was signed by your domain and not altered | | DMARC | SPF/DKIM align with the visible From address, plus the failure policy | Because DMARC alignment can depend on SPF, keeping the SPF side valid matters. [AutoSPF](/) flattens and maintains your SPF record automatically so it stays within the 10-lookup limit and keeps passing — which helps DKIM and DMARC alignment stay healthy overall. ## Common DKIM problems DKIM most often breaks from a missing or truncated DNS record, a selector mismatch, or a message being modified in transit by a forwarder or mailing list. If your signatures are not validating, [why DKIM fails](/dkim/why-dkim-fails/) walks through the usual causes and fixes. To confirm what a domain is publishing right now, run the free [DKIM lookup tool](/tools/dkim-lookup/) — it fetches the record for a given selector and shows whether the key is present and well-formed. ## Frequently Asked Questions ### What is DKIM? DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. Your mail server signs each email with a private key, and receiving servers verify that signature using a public key published in your DNS. A valid signature proves the message came from your domain and was not altered in transit. ### Is DKIM required? DKIM is not strictly required to send email, but it is effectively expected. Major providers like Google and Yahoo now require authentication for bulk senders, and DMARC needs a passing, aligned DKIM (or SPF) result to protect your domain. Without DKIM, your mail is far more likely to be filtered as spam or spoofed by attackers. ### What is the difference between DKIM, SPF and DMARC? SPF authorizes which servers may send mail for your domain, DKIM cryptographically signs each message to prove it came from you unaltered, and DMARC ties both to the visible From address and sets a policy for failures. SPF checks the sending source, DKIM checks message integrity, and DMARC enforces alignment between them. ### How do I check if DKIM is set up correctly? Send a test message to an address you control and inspect the headers for `dkim=pass`, or use a DKIM lookup tool to query your published key by selector. The tool confirms the record exists, is well-formed, and returns a valid public key. Our free [DKIM lookup tool](/tools/dkim-lookup/) checks any domain and selector in seconds. Go Deeper ## DKIM, Explained in Depth [ What Is DKIM? → The plain-English explanation of DomainKeys Identified Mail. ](/dkim/what-is-dkim/)[ DKIM Record → The DNS TXT record, its tags, and how to read one. ](/dkim/dkim-record/)[ DKIM Selector → The label that points to a specific public key. ](/dkim/dkim-selector/)[ DKIM Signature → The DKIM-Signature header and how verification works. ](/dkim/dkim-signature/)[ How to Generate a DKIM Record → Create the key pair and publish it, step by step. ](/dkim/how-to-generate-a-dkim-record/)[ Why DKIM Fails → Common failure causes and how to fix them. ](/dkim/why-dkim-fails/) Related guides: [DKIM Lookup tool](/tools/dkim-lookup/), [how to create an SPF record](/how-to-create-an-spf-record/), [SPF record syntax](/spf-record-format/), and [preventing email spoofing](/email-spoofing/). ## DKIM is one layer — keep SPF valid too AutoSPF flattens your SPF record and keeps it under the 10-lookup limit automatically, so SPF, DKIM and DMARC alignment all stay healthy. [Start Free Trial→](https://subscriptions.zoho.com/subscribe/31162770c20bc42aba9c86185ed6106a6a2bba0f6b053217ad482bf477cf719e/smb%5F1)[View Plans & Pricing](/pricing/) Rated 5/5 on G2 · Trusted since 2018 ## What Our Customers Say ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is DKIM?","acceptedAnswer":{"@type":"Answer","text":"DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. Your mail server signs each email with a private key, and receiving servers verify that signature using a public key published in your DNS. A valid signature proves the message came from your domain and was not altered in transit."}},{"@type":"Question","name":"Is DKIM required?","acceptedAnswer":{"@type":"Answer","text":"DKIM is not strictly required to send email, but it is effectively expected. Major providers like Google and Yahoo now require authentication for bulk senders, and DMARC needs a passing, aligned DKIM (or SPF) result to protect your domain. Without DKIM, your mail is far more likely to be filtered as spam or spoofed by attackers."}},{"@type":"Question","name":"What is the difference between DKIM, SPF and DMARC?","acceptedAnswer":{"@type":"Answer","text":"SPF authorizes which servers may send mail for your domain, DKIM cryptographically signs each message to prove it came from you unaltered, and DMARC ties both to the visible From address and sets a policy for failures. SPF checks the sending source, DKIM checks message integrity, and DMARC enforces alignment between them."}},{"@type":"Question","name":"How do I check if DKIM is set up correctly?","acceptedAnswer":{"@type":"Answer","text":"Send a test message to an address you control and inspect the headers for `dkim=pass`, or use a DKIM lookup tool to query your published key by selector. The tool confirms the record exists, is well-formed, and returns a valid public key. Our free [DKIM lookup tool](/tools/dkim-lookup/) checks any domain and selector in seconds."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"DKIM","item":"https://autospf.com/dkim/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```