Learn · 5 minute read
What is DKIM, and how do you set it up?
DKIM puts a digital signature on every message you send. Receiving servers check it against a public key in your DNS to confirm the message really came from your domain and was not changed on the way.
How DKIM works
Your email provider signs each message with a private key only it holds. The signature, and the name of the key to use (the selector), travel in the message’s headers. The receiving server looks up the matching public key in your DNS and checks the signature. If the message was changed after signing, the check fails.
Because the signature travels with the message, DKIM usually survives forwarding, which SPF does not.
What a DKIM record looks like
The public key is published at selector._domainkey.yourdomain.com. Depending on the provider, you add either a TXT record holding the key:
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."or a CNAME that points at a key the provider keeps (and can rotate for you):
abc123._domainkey.example.com CNAME abc123.dkim.amazonses.comThe selector is a name your provider chooses, such as google, selector1 or a random string. Each service you send through has its own, so one domain can have several DKIM records.
How to set it up
- In your email provider’s settings, add your domain. It shows the DKIM record or records to create.
- Add them at your DNS provider exactly as shown. Copy the whole value; keys are long.
- Go back to the provider and press verify. Most show a green tick within minutes, and some take longer.
- Check it from outside. Because the selector is provider-specific, enter it when you check. Run your domain through the free domain checker to see it.
Common problems
- The record was cut off. Some DNS tools split long values or add quotes. If verification fails, compare the stored value with the one your provider gave you.
- The domain in the signature does not match. For DMARC, the signing domain has to line up with your From domain. Sending through a provider with its own domain signature is not enough; set up your own domain.
- A key that is too short. Use 2048-bit keys where your provider offers them.
- Old selectors left behind. A record for a service you stopped using is harmless, but rotate or remove keys you no longer control.
Common questions
What is a DKIM selector?
A name that says which key to use. It is the part before ._domainkey in the DNS record. It lets one domain have many keys at once, for different services or for rotating keys.
Why can’t a checker find my DKIM record?
DNS cannot list a domain’s records, so a checker has to guess selector names. If you know the selector your provider gave you, enter it and the check will look at exactly that name.
Is DKIM or SPF more important?
Both matter. DKIM is generally the more robust of the two because it survives forwarding, and it is the one DMARC leans on most often.
Should I rotate DKIM keys?
It is good practice to rotate periodically. With CNAME-style DKIM your provider can rotate the key without any change at your DNS.
Keep reading
- What is SPF, and how do you set it up?
- What is DMARC, and how do you roll it out safely?
- Why your emails go to spam, and how to fix it
SendSend is an email API that checks these records for you and tells you when a domain is verified. Get started free.