What is DKIM? How DKIM records work, and how to set one up

DKIM (DomainKeys Identified Mail, RFC 6376) is an email authentication standard. The sending server signs each outgoing message with a private key, and publishes the matching public key in DNS. The receiving server reads the signature, looks up the public key under your domain and checks that the two match. If they do, the message was sent by someone holding your key and its signed parts were not altered.

Gmail, Yahoo and Microsoft now require DKIM, or SPF, for all senders, and both plus DMARC for anyone sending in bulk. You can check what your domain sends against those rules with the bulk sender requirements checker.

1. Your mail service generates a key pair. The private key stays on the sending servers; the public key goes into a DNS TXT record.
2. When a message is sent, the server hashes chosen headers (From, Subject, Date and others) and the body, signs the hash with the private key and adds a DKIM-Signature header.
3. The receiving server reads the d= (domain) and s= (selector) tags in that header and fetches the public key from selector._domainkey.domain.
4. It recomputes the hash and verifies the signature with the public key. The result, pass or fail, is recorded in the Authentication-Results header and fed into DMARC.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google;
  h=from:to:subject:date:message-id; bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
  b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVFOk4yAUoqOB...

A DKIM record is a TXT record at selector._domainkey.yourdomain.com. Its value is a list of tags separated by semicolons:

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

A 2048-bit RSA key is longer than the 255 characters one DNS string can hold, so the record is split into several quoted strings. Most DNS providers do this for you. A key that fails to decode is usually a copy-paste error at that split.

The selector is the label in front of ._domainkey. It lets one domain publish many keys at once, one for each service that sends as you, such as your mailbox provider, a newsletter tool and a help desk. DNS has no way to list them, so you need the name to look a key up.

1. Send a message from the service to an address you can read.
2. Open the raw message: "Show original" in Gmail, "View message source" in Outlook.
3. Find the DKIM-Signature header whose d= is your domain. The s= value is the selector.

Then enter the domain and selector in the DKIM checker. It also tries the common selectors above if you leave the field empty.

Google Workspace

1. In the Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Pick the domain and choose Generate new record. Keep the 2048-bit key length and the google prefix unless you need another.
3. Add the TXT record it shows at your DNS provider, at google._domainkey.
4. Wait for DNS to update (check with the TXT lookup), then press Start authentication.

Microsoft 365

1. In the Microsoft Defender portal, open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
2. Select your custom domain. The portal shows two CNAME records, for selector1._domainkey and selector2._domainkey.
3. Create both CNAMEs at your DNS provider, then turn on signing for the domain. Microsoft rotates between the two keys itself.

Other services (newsletter tools, CRMs, help desks) each have a "domain authentication" or "sender authentication" page that gives you their records. Every service that sends as your domain needs its own.

DKIM alone does not stop spoofing, because a message can be validly signed by any domain. DMARC is what ties the signing domain to the From address and tells receivers what to do when neither matches. Check the other two with the SPF checker and the DMARC checker.

To see the result for a real message, open its raw source and read Authentication-Results. It names the domain and selector checked and why it failed.