The one-sentence version#
DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.
Why you should care#
DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.
The mental model#
Think of DKIM signing as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.
Your first setup, step by step#
- Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
- Publish the public key as a TXT record at selector._domainkey.yourdomain.com.
- Enable signing in the sending platform and confirm the d= tag in outgoing headers matches your organizational domain.
- Send a test to a seed address and inspect the Authentication-Results header for dkim=pass.
- Schedule key rotation every 6 to 12 months using a second selector so old mail still verifies.
s1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."Words you will see#
- Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
- Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
- Reputation: the provider's running score of your domain and IP.
- Placement: whether a message reaches the inbox, spam, or is rejected.
Common mistakes#
- Signing with the ESP's domain (d=esp.com) instead of yours, which passes DKIM but fails DMARC alignment.
- Copying the public key with line breaks or quotes broken, producing a permanent verification failure.
- Modifying message bodies after signing (footers injected by gateways) which invalidates the signature.
- Never rotating keys, leaving a compromised key valid indefinitely.
Frequently asked questions#
What is a DKIM selector?
A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.
Why does DKIM pass but DMARC fail?
Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.
Can I use one DKIM key for all my ESPs?
You can publish separate selectors per vendor. Never share private keys between platforms.