DKIM

DKIM (DomainKeys Identified Mail) is an email authentication standard that lets a receiving server confirm a message was genuinely sent by your domain and was not altered in transit. Your outbound mail server signs each message with a private key, and receivers verify that signature against a matching public key published in your domain’s DNS.

DKIM is one of the three pillars of modern email authentication, alongside SPF and DMARC. Together they decide whether your mail reaches the inbox or lands in spam — and whether attackers can spoof your domain. This page explains what DKIM is, how it works, and how each piece fits together.

How DKIM works

DKIM works as a sign-on-send, verify-on-receipt handshake built on public-key cryptography. When your mail server sends a message, it generates a cryptographic hash of selected headers (and usually the body), encrypts that hash with a private key that only your server holds, and attaches the result to the email as a DKIM-Signature header.

The matching public key lives in your domain’s DNS as a TXT record. When a receiving server accepts the message, it reads the DKIM-Signature header, looks up the public key in DNS, and uses it to verify the signature. If the signature validates, the receiver knows two things: the message really came from a server authorized to sign for your domain, and the signed content was not tampered with along the way. If anything was changed — or the key does not match — DKIM verification fails.

Because the private key never leaves your infrastructure, a spoofer cannot forge a valid DKIM signature for your domain.

The parts of DKIM

DKIM is made up of a few coordinated pieces, each with its own detailed guide:

• The DKIM record — the DNS TXT record that publishes your public key and DKIM settings so receivers can find and verify signatures.
• The DKIM selector — a short label that tells receivers which key to look up, allowing you to run multiple keys (for different providers or key rotations) on one domain.
• The DKIM signature — the DKIM-Signature header stamped onto every outgoing message, containing the signing domain, the selector, and the cryptographic hash itself.

Understanding how these three connect makes the rest of DKIM setup and troubleshooting far easier.

How to set up DKIM

Setting up DKIM is a short, repeatable process:

1. Generate a key pair in your mail provider’s console — the private key stays with the provider, and you are given the public key to publish.
2. Publish the public key as a TXT record in DNS at selector._domainkey.yourdomain.com. See how to generate a DKIM record for the exact steps.
3. Enable signing in your provider so outbound mail is stamped with the DKIM signature.
4. Verify that messages are signed and passing before you rely on it.

In practice, DKIM keys are generated inside your mail provider’s console — Google Workspace, Microsoft 365, or your ESP — rather than by hand, so most of the work is copying the provided record into DNS.

A published DKIM record looks like this:

selector1._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqF...GfMA0=; t=s"

Here selector1 is the selector, v=DKIM1 marks it as a DKIM record, k=rsa names the key type, and p= carries the base64-encoded public key.

DKIM, SPF and DMARC together

DKIM does not work in isolation. It complements SPF, which authorizes which servers are allowed to send mail for your domain. SPF checks the connecting server’s IP against your published list; DKIM checks the cryptographic signature on the message itself. The two protect different things — sending source versus message integrity — and either one can pass or fail independently.

DMARC is the policy layer that ties them to the address recipients actually see. DMARC requires that a passing SPF or DKIM result aligns with the visible From: domain, then tells receivers what to do when neither aligns — deliver, quarantine, or reject. This alignment is what stops attackers from passing authentication on a domain they control while spoofing yours in the From line.

Standard	What it verifies
SPF	Which servers may send for your domain
DKIM	The message was signed by your domain and not altered
DMARC	SPF/DKIM align with the visible From address, plus the failure policy

Because DMARC alignment can depend on SPF, keeping the SPF side valid matters. AutoSPF flattens and maintains your SPF record automatically so it stays within the 10-lookup limit and keeps passing — which helps DKIM and DMARC alignment stay healthy overall.

Common DKIM problems

DKIM most often breaks from a missing or truncated DNS record, a selector mismatch, or a message being modified in transit by a forwarder or mailing list. If your signatures are not validating, why DKIM fails walks through the usual causes and fixes. To confirm what a domain is publishing right now, run the free DKIM lookup tool — it fetches the record for a given selector and shows whether the key is present and well-formed.

Frequently Asked Questions

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. Your mail server signs each email with a private key, and receiving servers verify that signature using a public key published in your DNS. A valid signature proves the message came from your domain and was not altered in transit.

Is DKIM required?

DKIM is not strictly required to send email, but it is effectively expected. Major providers like Google and Yahoo now require authentication for bulk senders, and DMARC needs a passing, aligned DKIM (or SPF) result to protect your domain. Without DKIM, your mail is far more likely to be filtered as spam or spoofed by attackers.

What is the difference between DKIM, SPF and DMARC?

SPF authorizes which servers may send mail for your domain, DKIM cryptographically signs each message to prove it came from you unaltered, and DMARC ties both to the visible From address and sets a policy for failures. SPF checks the sending source, DKIM checks message integrity, and DMARC enforces alignment between them.

How do I check if DKIM is set up correctly?

Send a test message to an address you control and inspect the headers for dkim=pass, or use a DKIM lookup tool to query your published key by selector. The tool confirms the record exists, is well-formed, and returns a valid public key. Our free DKIM lookup tool checks any domain and selector in seconds.