DomainKeys Identified Mail (DKIM)
Cryptographic signatures on every message
What it is
DKIM adds a digital signature to the headers of every outgoing message. The signing server holds a private key; the matching public key is published in DNS under a selector.
Receivers fetch the public key from <selector>._domainkey.<domain>, verify the signature and know the signed headers and body were not modified and that the signing domain (d=) vouched for the message.
How it works
- The DKIM-Signature header names the signing domain (d=) and the selector (s=).
- The public key is a TXT record at selector._domainkey.domain containing v=DKIM1, k= (key type) and p= (base64 key).
- Selectors let you run several keys at once, for example one per email provider, and rotate keys without downtime.
- An empty p= value means the key has been revoked.
- For DMARC alignment, the d= domain must match (or share the organizational domain with) the visible From domain.
Examples
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv3…IDAQAB
2048-bit RSA key for the "google" selector (truncated).
s1.domainkey.u1234.wl.sendgrid.net
Providers often ask you to CNAME the selector to a key they rotate.
Common mistakes
-
1024-bit (or smaller) RSA keys
Use 2048-bit RSA. 1024-bit keys are considered weak and some receivers ignore them.
-
Leaving t=y in production
Testing mode tells receivers to treat failures leniently. Remove it once signing works.
-
Broken TXT splitting
Long keys must be split into 255-character strings in one record, not into separate records.
-
Not signing with your own domain
Many services sign with their domain by default. Set up custom DKIM so d= aligns with your From domain.
-
Never rotating keys
Rotate keys periodically using a new selector, then revoke the old one.
Specifications
Check your domain's DKIM
Run a free scan and see exactly what to fix.