--- title: "DKIM Record: Format, Tags & How to Read One | AutoSPF" description: "A DKIM record is a DNS TXT record published at selector._domainkey.yourdomain.com that holds the public key receivers use to verify your DKIM signatures. I" image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/dkim/dkim-record/" --- # DKIM Record A DKIM record is a DNS TXT record published at selector.\_domainkey.yourdomain.com that holds the public key receivers use to verify your DKIM signatures. Its tags include v (version), k (key type) and p (the public key) - an empty p= means the key is revoked. This guide is part of our complete guide to [DKIM](/dkim/). Related: [the DKIM selector](/dkim/dkim-selector/) and [the DKIM signature](/dkim/dkim-signature/). **A DKIM record is a specially formatted TXT record published in your domain’s DNS that holds the public key receiving mail servers use to verify a message’s DKIM signature. It confirms the message was authorized by your domain and has not been altered in transit.** ## What a DKIM record looks like A DKIM record is a single string of `tag=value` pairs separated by semicolons. The bulk of it is the public key, which is why DKIM records are much longer than SPF or DMARC records. A typical record looks like this: ``` v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ... ``` Because DNS TXT records have a 255-character limit per string, most providers split the long `p=` value into multiple quoted chunks that DNS software concatenates automatically. When you view the record in a lookup tool it is reassembled into one continuous string. The order of tags does not matter, and whitespace around the semicolons is ignored. ## The tags in a DKIM record Each tag controls one aspect of how the key is used. Only `p=` is strictly required in practice, but `v=` and `k=` are almost always present. | Tag | Name | Meaning | | --- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | v | Version | The DKIM version. Must be DKIM1 and, when present, must come first. | | k | Key type | The public key algorithm. rsa is standard; ed25519 is a newer, shorter alternative. | | p | Public key | The base64-encoded public key itself. An **empty p= means the key has been revoked** and any signature using this selector will fail. | | t | Flags | Optional flags. t=y marks the domain as testing (verifiers should not treat failures harshly); t=s forbids subdomain use. | | h | Hash algorithms | The permitted signing hash algorithms, such as sha256. Limits which hashes verifiers will accept. | | s | Service type | The service the key is valid for. email restricts the key to email; \* (default) allows all services. | ## Where a DKIM record lives A DKIM record is not published at your root domain. Instead it lives at a subdomain built from a selector plus the fixed `_domainkey` label: ``` selector._domainkey.yourdomain.com ``` The [selector](/dkim/dkim-selector/) is a label your mail provider chooses, and it determines the exact host where the record is stored. For example, if Google Workspace signs your mail with the selector `google`, the record is published as a TXT record at `google._domainkey.yourdomain.com`. A domain can have many selectors at once, one for each key or sending service, so a single domain often holds several DKIM records side by side. ## How to find and check your DKIM record The challenge with DKIM is that you cannot look up the record unless you already know the selector, and DNS gives you no way to list every selector on a domain. The reliable way to find it is to read a real message your domain sent. Open the raw headers of that message and locate the `DKIM-Signature` header. The `s=` tag inside it is the selector, and the `d=` tag is the signing domain. Combine them as `s._domainkey.d` to get the exact host to query. For example, `s=selector1; d=yourdomain.com` means the record lives at `selector1._domainkey.yourdomain.com`. Once you have the host, query it as a TXT record with `dig`, `nslookup`, or a browser-based checker. Our free [DKIM lookup tool](/tools/dkim-lookup/) makes this easier still: it auto-scans dozens of common selectors used by Google, Microsoft, Amazon SES, Mailchimp, and other major providers, so you can often find and validate your record without digging through headers at all. It also flags an empty or malformed `p=` value that would cause verification to fail. ## How to add a DKIM record Adding DKIM is a three-step process handled mostly through your email provider: 1. **Generate the key pair.** In your sending platform (Google Workspace, Microsoft 365, your ESP, or your mail server), enable DKIM and let it generate a public/private key pair. The provider keeps the private key and gives you the public key formatted as a DKIM record. See [how to generate a DKIM record](/dkim/how-to-generate-a-dkim-record/) for the exact steps per provider. 2. **Publish the TXT record.** In your DNS host, create a TXT record at the `selector._domainkey.yourdomain.com` host the provider specifies, and paste in the value it gave you. 3. **Verify.** Wait for DNS to propagate, then use a lookup tool to confirm the record resolves and the public key is intact. Send a test message and check that the `DKIM-Signature` passes on the receiving side. ## Frequently Asked Questions ### What is a DKIM record? A DKIM record is a TXT record in your domain’s DNS that stores the public key used to verify DKIM signatures on your outgoing email. Receiving servers fetch it to confirm a message was authorized by your domain and was not modified in transit, which strengthens deliverability and protects against spoofing. ### What does the p= tag in a DKIM record mean? The `p=` tag holds the base64-encoded public key that verifiers use to check the message’s cryptographic signature. It is the essential part of the record. If `p=` is present but empty, it signals that the key has been revoked, and any message signed with that selector will fail DKIM verification. ### Where is a DKIM record stored? A DKIM record is stored as a TXT record at a special DNS host formed by the selector and the `_domainkey` label, in the form `selector._domainkey.yourdomain.com`. The selector, chosen by your mail provider, determines the exact host, which is why one domain can hold several DKIM records at different selectors. ### How many DKIM records can a domain have? A domain can have as many DKIM records as it has selectors, and there is no fixed limit. Each sending service or key rotation typically uses its own selector, so a domain that sends through several platforms will publish a separate DKIM record for each one, all coexisting under different `_domainkey` hosts. Rated 5/5 on G2 · Trusted since 2018 ## Trusted by 50,000+ domains ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) ### "Great service and great support" > AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. GF Greg F. Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a DKIM record?","acceptedAnswer":{"@type":"Answer","text":"A DKIM record is a TXT record in your domain's DNS that stores the public key used to verify DKIM signatures on your outgoing email. Receiving servers fetch it to confirm a message was authorized by your domain and was not modified in transit, which strengthens deliverability and protects against spoofing."}},{"@type":"Question","name":"What does the p= tag in a DKIM record mean?","acceptedAnswer":{"@type":"Answer","text":"The `p=` tag holds the base64-encoded public key that verifiers use to check the message's cryptographic signature. It is the essential part of the record. If `p=` is present but empty, it signals that the key has been revoked, and any message signed with that selector will fail DKIM verification."}},{"@type":"Question","name":"Where is a DKIM record stored?","acceptedAnswer":{"@type":"Answer","text":"A DKIM record is stored as a TXT record at a special DNS host formed by the selector and the `_domainkey` label, in the form `selector._domainkey.yourdomain.com`. The selector, chosen by your mail provider, determines the exact host, which is why one domain can hold several DKIM records at different selectors."}},{"@type":"Question","name":"How many DKIM records can a domain have?","acceptedAnswer":{"@type":"Answer","text":"A domain can have as many DKIM records as it has selectors, and there is no fixed limit. Each sending service or key rotation typically uses its own selector, so a domain that sends through several platforms will publish a separate DKIM record for each one, all coexisting under different `_domainkey` hosts."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"DKIM","item":"https://autospf.com/dkim/"},{"@type":"ListItem","position":3,"name":"DKIM Record","item":"https://autospf.com/dkim/dkim-record/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```