DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.
The metrics that matter#
- Authentication pass rate: share of mail passing SPF, DKIM, and DMARC alignment. Healthy: 99% or higher.
- Spam complaint rate: Gmail enforces at 0.3%; stay under 0.1%.
- Hard bounce rate: under 2%; above 5% triggers platform reviews.
- Inbox placement: above 90% across major providers via seed tests.
- Engagement: click and reply rates by segment; opens are unreliable after Mail Privacy Protection.
Where to read them#
- Google Postmaster Tools for Gmail domain reputation, spam rate, and authentication.
- Microsoft SNDS and JMRP for Outlook.com IP reputation and complaints.
- Your ESP's delivery and bounce reports.
- DMARC aggregate reports for authentication by source.
Improving the numbers#
- Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
- Publish the public key as a TXT record at selector._domainkey.yourdomain.com.
- Enable signing in the sending platform and confirm the d= tag in outgoing headers matches your organizational domain.
- Send a test to a seed address and inspect the Authentication-Results header for dkim=pass.
- Schedule key rotation every 6 to 12 months using a second selector so old mail still verifies.
s1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."Frequently asked questions#
What is a DKIM selector?
A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.
Why does DKIM pass but DMARC fail?
Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.
Can I use one DKIM key for all my ESPs?
You can publish separate selectors per vendor. Never share private keys between platforms.