DKIM, DomainKeys Identified Mail, puts a signature in each message's headers. The sending service signs with a private key it holds. The receiver fetches the matching public key from your DNS and checks the signature. A pass proves which domain signed the message and that the signed parts arrived unchanged.
Does DKIM encrypt my email? No. It signs it. Anyone on the path can read the message. What they can't do is change the signed headers or the body without the signature failing.
If you're here to turn it on, jump to setting up DKIM. If a message failed, our DKIM fail guide works from the failing message's headers.
Signing and checking
When the sending service signs a message, it takes a hash of the body and a hash of a chosen set of headers, and signs both with its private key. The result goes into a DKIM-Signature header along with the signing domain and a selector.
The receiver reads that header, builds a DNS name from the selector and the domain, and fetches a TXT record there. The record holds the public key. The receiver recomputes both hashes from the message it received and checks them against the signature. If everything matches, dkim=pass goes into Authentication-Results.
RFC 6376 defines all of it. The From header must be among the signed headers, so a pass ties the signature to the address the reader sees.
The selector
The selector says which key the receiver fetches. The receiver builds the DNS name from the s= and d= tags in the signature: the selector, then ._domainkey., then the domain.
Selectors exist so a domain can publish more than one key at the same time. Each service that signs for you gets its own selector and its own key, so you can replace the helpdesk's key without touching staff mail. Rotation works the same way: publish the next key under a fresh selector, switch signing to it, and remove the old one once mail signed with it has stopped arriving.
Google Workspace uses the selector google by default. Microsoft 365 uses selector1 and selector2, one active and one held for the next rotation. Every other platform documents its own, and many hand you a CNAME that points at a key they host.
Don't guess a selector. Send yourself a message from the service and read s= from the real signature. Our DKIM checker then fetches the record for that selector and domain and shows what a receiver sees.
The DKIM record
A DKIM record is a TXT record at the selector's name, and it holds the public key. Its value is a list of tags:
v=DKIM1 marks the version. k=rsa is the key type. p= is the public key itself, a long string of base64. An empty p= means the key was revoked, and mail signed with it fails from that point on.
The optional t=y flag marks the key as being in test mode, and receivers then treat a message it signed the same as an unsigned one. With t=s, the key is valid only for the exact domain and not for its subdomains. Leave both out unless your platform's instructions include them.
Platforms often give a long key as several quoted strings in one TXT record. Receivers join them without spaces. Paste it exactly as your platform gives it, and check the whole value after publishing. A key cut short by a DNS panel's length limit is the most common reason a fresh setup fails.
RFC 8301 requires RSA keys of at least 1024 bits and recommends 2048. Google offers both sizes and recommends 2048 where your DNS host supports it. Microsoft's PowerShell setup defaults to 1024 with 2048 as an option.
The DKIM-Signature header
| Tag | What it holds |
|---|---|
d= | The signing domain. This is the domain DMARC compares with the From address. |
s= | The selector. Combine with d= to find the key. |
a= | The algorithm, normally rsa-sha256. rsa-sha1 is obsolete and receivers may reject it. |
h= | The headers that were signed, in order. From is always among them. |
bh= | The hash of the body at signing time. |
b= | The signature itself. |
c= | How whitespace is treated before hashing. relaxed/relaxed tolerates small changes in spacing. |
t= and x= | When the signature was made and when it expires. |
A message can carry more than one signature. A marketing platform often adds its own under its domain alongside one under yours. Read each d=, because only the one matching your From domain counts for DMARC.
Forwarding and edits
SPF fails whenever a forwarder delivers your mail from its own server. DKIM passes whichever server delivered the message, as long as the signed parts are intact. That's why DKIM keeps your mail passing DMARC through forwarding and mailing lists, and why it's the check to get right first.
The exception is anything that changes the body or a signed header after signing. A gateway adding a footer, a rewritten link or a mailing list tagging the subject each break the body hash or the header hash. Our body hash guide shows how to find what changed the message.
For DMARC, the signing domain has to match the From domain. A platform that signs only with its own domain gives you a passing signature that doesn't align. Enable custom-domain signing at the platform so d= is your domain. Our alignment guide covers the relaxed and strict forms.
DKIM setup at each sending service
You turn on DKIM in each sending service separately. Signing your staff mail does nothing for the invoice app. Work through each platform that sends as your domain.
Google Workspace. In the Admin console, open Apps > Google Workspace > Gmail > Authenticate email, choose the domain and generate a key. Keep the google prefix and pick 2048 bits if your DNS host accepts a value that long. Publish the TXT record at google._domainkey, then return and click Start authentication. According to Google's DKIM setup page, it can take up to 48 hours to start working.
Microsoft 365. In the Defender portal, open Email authentication settings > DKIM and select the domain. Microsoft gives you two CNAME records, at selector1._domainkey and selector2._domainkey, each pointing at a target specific to your tenant. Publish both, then enable signing. Only one selector is active at a time and the other is held for rotation. Microsoft's DKIM setup page has the exact target format.
Every other platform. Look for domain authentication or sender authentication in the platform's settings. Most give you a CNAME or a TXT record and a button to verify it. Our provider pages cover each one, including where the signing setting lives and what it takes to sign with your domain.
After each one, send a test to a mailbox outside your company and read Authentication-Results. You want dkim=pass with header.d= showing your domain. Send the test from the platform itself, because a test from your own mailbox only checks your staff mail.
Key rotation
Platforms rotate keys. With a CNAME, your record follows the rotation for you. A TXT key you pasted by hand stays as it was. When a platform retires that key, its mail starts failing DKIM, and DMARC then depends on SPF alone, which breaks on forwarding.
On a paid plan we email you when a source first fails DMARC. You then hear about a retired key the day the reports arrive, instead of when a customer asks why the invoice went to spam. The weekly digest shows the reported results by source. Your first domain is free.
Read the key a selector publishes for your domain
The record as receivers fetch it, with the key length and the faults marked.
Free · No signup · The result names what to change
Questions
What does DKIM stand for?
DomainKeys Identified Mail. The sending service signs each message with a private key, and the receiver checks the signature against a public key published in your DNS. RFC 6376 defines it.
What is a DKIM selector?
A name that picks which public key to fetch. The receiver reads it from the s= tag in the signature and looks up selector._domainkey.yourdomain in DNS. With selectors, a domain can publish several keys at once, one per service or for rotation.
Does DKIM encrypt email?
No. The message travels in the clear. DKIM signs it, so a receiver can prove which domain signed it and that the signed headers and body didn't change in transit.
How do I find my DKIM selector?
Send yourself a message from the service and read the DKIM-Signature header. The s= tag is the selector and d= is the signing domain. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2.
Keep reading
Checking as you go? The DMARC checker reads the policy you are moving up, the SPF and DKIM checkers show whether your senders will survive it, and the report analyzer reads an aggregate report you already have. No signup.
DomainCanary is a DMARC enforcement service that protects your domain from email spoofing without blocking your own mail.