DKIM signing best practices for marketing agencies

Agencies send on behalf of many client domains and must isolate reputation per client.

What DKIM signing is#

DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.

Why it matters#

DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.

Implementation plan for marketing agencies#

1. Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
2. Publish the public key as a TXT record at selector._domainkey.yourdomain.com.
3. Enable signing in the sending platform and confirm the d= tag in outgoing headers matches your organizational domain.
4. Send a test to a seed address and inspect the Authentication-Results header for dkim=pass.
5. Schedule key rotation every 6 to 12 months using a second selector so old mail still verifies.

s1._domainkey.example.com.  IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Priorities specific to marketing agencies#

Agencies send on behalf of many client domains and must isolate reputation per client. Weight your effort toward the steps above that address this constraint first, and measure with metrics that match how marketing agencies generate value from email.

Common mistakes#

• Signing with the ESP's domain (d=esp.com) instead of yours, which passes DKIM but fails DMARC alignment.
• Copying the public key with line breaks or quotes broken, producing a permanent verification failure.
• Modifying message bodies after signing (footers injected by gateways) which invalidates the signature.
• Never rotating keys, leaving a compromised key valid indefinitely.

Frequently asked questions#