DKIM Record
A DKIM record is a DNS TXT record published at selector._domainkey.yourdomain.com that holds the public key receivers use to verify your DKIM signatures. Its tags include v (version), k (key type) and p (the public key) - an empty p= means the key is revoked.
This guide is part of our complete guide to DKIM. Related: the DKIM selector and the DKIM signature.
A DKIM record is a specially formatted TXT record published in your domain’s DNS that holds the public key receiving mail servers use to verify a message’s DKIM signature. It confirms the message was authorized by your domain and has not been altered in transit.
What a DKIM record looks like
A DKIM record is a single string of tag=value pairs separated by semicolons. The bulk of it is the public key, which is why DKIM records are much longer than SPF or DMARC records. A typical record looks like this:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...Because DNS TXT records have a 255-character limit per string, most providers split the long p= value into multiple quoted chunks that DNS software concatenates automatically. When you view the record in a lookup tool it is reassembled into one continuous string. The order of tags does not matter, and whitespace around the semicolons is ignored.
The tags in a DKIM record
Each tag controls one aspect of how the key is used. Only p= is strictly required in practice, but v= and k= are almost always present.
| Tag | Name | Meaning |
|---|---|---|
v | Version | The DKIM version. Must be DKIM1 and, when present, must come first. |
k | Key type | The public key algorithm. rsa is standard; ed25519 is a newer, shorter alternative. |
p | Public key | The base64-encoded public key itself. An empty p= means the key has been revoked and any signature using this selector will fail. |
t | Flags | Optional flags. t=y marks the domain as testing (verifiers should not treat failures harshly); t=s forbids subdomain use. |
h | Hash algorithms | The permitted signing hash algorithms, such as sha256. Limits which hashes verifiers will accept. |
s | Service type | The service the key is valid for. email restricts the key to email; * (default) allows all services. |
Where a DKIM record lives
A DKIM record is not published at your root domain. Instead it lives at a subdomain built from a selector plus the fixed _domainkey label:
selector._domainkey.yourdomain.comThe selector is a label your mail provider chooses, and it determines the exact host where the record is stored. For example, if Google Workspace signs your mail with the selector google, the record is published as a TXT record at google._domainkey.yourdomain.com. A domain can have many selectors at once, one for each key or sending service, so a single domain often holds several DKIM records side by side.
How to find and check your DKIM record
The challenge with DKIM is that you cannot look up the record unless you already know the selector, and DNS gives you no way to list every selector on a domain. The reliable way to find it is to read a real message your domain sent.
Open the raw headers of that message and locate the DKIM-Signature header. The s= tag inside it is the selector, and the d= tag is the signing domain. Combine them as s._domainkey.d to get the exact host to query. For example, s=selector1; d=yourdomain.com means the record lives at selector1._domainkey.yourdomain.com.
Once you have the host, query it as a TXT record with dig, nslookup, or a browser-based checker. Our free DKIM lookup tool makes this easier still: it auto-scans dozens of common selectors used by Google, Microsoft, Amazon SES, Mailchimp, and other major providers, so you can often find and validate your record without digging through headers at all. It also flags an empty or malformed p= value that would cause verification to fail.
How to add a DKIM record
Adding DKIM is a three-step process handled mostly through your email provider:
-
Generate the key pair. In your sending platform (Google Workspace, Microsoft 365, your ESP, or your mail server), enable DKIM and let it generate a public/private key pair. The provider keeps the private key and gives you the public key formatted as a DKIM record. See how to generate a DKIM record for the exact steps per provider.
-
Publish the TXT record. In your DNS host, create a TXT record at the
selector._domainkey.yourdomain.comhost the provider specifies, and paste in the value it gave you. -
Verify. Wait for DNS to propagate, then use a lookup tool to confirm the record resolves and the public key is intact. Send a test message and check that the
DKIM-Signaturepasses on the receiving side.
Frequently Asked Questions
What is a DKIM record?
A DKIM record is a TXT record in your domain’s DNS that stores the public key used to verify DKIM signatures on your outgoing email. Receiving servers fetch it to confirm a message was authorized by your domain and was not modified in transit, which strengthens deliverability and protects against spoofing.
What does the p= tag in a DKIM record mean?
The p= tag holds the base64-encoded public key that verifiers use to check the message’s cryptographic signature. It is the essential part of the record. If p= is present but empty, it signals that the key has been revoked, and any message signed with that selector will fail DKIM verification.
Where is a DKIM record stored?
A DKIM record is stored as a TXT record at a special DNS host formed by the selector and the _domainkey label, in the form selector._domainkey.yourdomain.com. The selector, chosen by your mail provider, determines the exact host, which is why one domain can hold several DKIM records at different selectors.
How many DKIM records can a domain have?
A domain can have as many DKIM records as it has selectors, and there is no fixed limit. Each sending service or key rotation typically uses its own selector, so a domain that sends through several platforms will publish a separate DKIM record for each one, all coexisting under different _domainkey hosts.