What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Your email provider signs each message with a private key, and publishes the matching public key in your DNS. Receiving servers look it up and check the signature: if it matches, the message really came from your domain and wasn't changed on the way. Together with SPF, it's what DMARC builds on, and since 2024 Gmail and Yahoo expect all three from anyone sending in bulk.
How to read a DKIM record
| Part | What it means |
|---|---|
v=DKIM1 | Marks the record as DKIM. Optional, but if present it must be first. |
k=rsa | The key type: rsa (the default) or ed25519. |
p=MIIBIjANBg… | The public key itself. Empty means the key was revoked. |
t=y | Test mode: receivers may ignore failures. Remove it once signing works. |
t=s | The signing domain must match exactly, not a subdomain. |
DKIM selectors for common email providers
| Provider | Selector | Record type |
|---|---|---|
| Google Workspace | google | TXT |
| Microsoft 365 (Office 365) | selector1, selector2 | CNAME |
| Mailchimp | k1, k2, k3 | CNAME |
| SendGrid | s1, s2 | CNAME |
| Zoho Mail | zoho or your own | TXT |
| Proton Mail | protonmail, protonmail2, protonmail3 | CNAME |
| Fastmail | fm1, fm2, fm3 | CNAME |
| Amazon SES | Three random selectors | CNAME |
Every service that sends email as your domain, like a newsletter tool, CRM or helpdesk, needs its own DKIM key, set up in that service. Your SPF record should list the same services.
Frequently asked questions
What is a DKIM record?
A DKIM record is a TXT record that publishes the public key your email provider uses to sign the mail it sends for you. Receivers use it to check the signature, which proves the message really came from your domain and was not changed on the way. It lives at selector._domainkey.yourdomain.com.
What is a DKIM selector?
The selector is the name in front of ._domainkey that says which key signed a message. Each service picks its own: Google Workspace uses google, Microsoft 365 uses selector1 and selector2, Mailchimp uses k1. One domain can have many selectors, one for every service that sends as it.
How do I find my DKIM selector?
Open an email you sent, view the original message or its headers, and find the DKIM-Signature header. The s= value is the selector and d= is the domain that signed it. Enter that selector above to check it directly.
Why does the checker say no DKIM was found when I have DKIM?
DNS has no way to list a domain's DKIM keys, so the checker tries the selectors the common providers use. Services such as Amazon SES, Postmark and SparkPost use random or date-based selectors that can't be guessed. Enter yours in the selector box to check it.
Should my DKIM key be 1024 or 2048 bits?
2048 bits. 1024-bit keys still work but are the old minimum, and keys under 1024 bits are ignored by Gmail and other large receivers. Google Workspace and Microsoft 365 both offer 2048-bit keys.
Do I need DKIM if I have SPF?
Yes. SPF breaks when mail is forwarded, and DKIM survives forwarding because the signature travels with the message. DMARC passes when either one passes and matches your domain, so having both keeps your mail out of spam even when one fails.