What Is a DKIM Record? How DKIM Works and How to Set It Up

What is a DKIM record?

A DKIM record is a DNS record that contains the public key used to verify messages signed by a particular domain and selector. It is related to, but different from, the DKIM signature added to an email header.

Three terms are easy to confuse:

• DKIM is the authentication standard.
• DKIM-Signature is the header added to a signed message.
• DKIM record is the DNS record containing the public key used by receivers.

The signature identifies the signing domain in the d= tag and the selector in the s= tag. A receiver combines them to query a host such as selector1._domainkey.example.com.

Why DKIM is important

• It protects signed content. A valid signature shows that the signed headers and body survived verification.
• It establishes domain-level accountability. The signer demonstrates control of the private key associated with the DNS-published public key.
• It supports DMARC. Aligned DKIM can let a message pass DMARC even when forwarding breaks SPF.
• It helps meet mailbox-provider requirements. Major providers expect authenticated mail, especially from bulk senders.

DKIM can prevent avoidable authentication failures and support deliverability, but reputation, consent, engagement, list quality, and content still influence filtering.

How DKIM works

DKIM uses a private and public key pair. The sending system keeps the private key secret and uses it to create a signature. The public key is published in DNS so receiving systems can verify that signature.

1. The sending service canonicalizes the selected headers and message body.
2. It calculates a body hash and creates a signature with the private key.
3. It adds a DKIM-Signature header containing the signing domain, selector, algorithms, signed-header list, body hash, and signature value.
4. The receiver reads the d= and s= tags and looks up the public key at s._domainkey.d.
5. The receiver verifies the body hash and signature, then records a result such as dkim=pass or dkim=fail.

The private key does not encrypt the message or its headers. DKIM is a signature-verification mechanism, not end-to-end encryption.

DKIM record example

A simplified DNS TXT value can look like this:

Use the exact host and value supplied by your email service. DNS interfaces handle domain suffixes and quotation marks differently, so avoid adding the domain twice or copying decorative quotation marks into the key.

What the DKIM-Signature header contains

Canonicalization defines how harmless formatting differences are normalized before verification. A signature may use simple or relaxed handling for headers and the body.

Selectors, key length, and rotation

A selector lets a domain publish more than one public key. Different providers can use different selectors, and a service can introduce a new selector during rotation without interrupting messages signed with the previous key.

Use 2048-bit RSA keys where the sending service and DNS provider support them. Keep private keys only in the signing system, rotate a compromised key immediately, and retire old public keys after messages signed with them no longer need verification. Record which team or vendor owns every selector.

DKIM, SPF, and DMARC: how they work together

SPF authorizes sending infrastructure. DKIM verifies a signature. DMARC connects one of those passing results to the domain recipients see and publishes reporting and handling policy.

How to set up DKIM for your domain

You need control of your domain’s DNS and access to the service that sends your mail. Repeat the process for every platform that sends using your domain.

1. Inventory every sending service and domain.
2. Generate or obtain a DKIM key pair in the sending service.
3. Copy the exact selector, DNS host, record type, and value supplied by the service.
4. Publish the TXT record or provider-specified CNAME in DNS.
5. Wait for DNS propagation, then enable or verify signing in the sending service.
6. Send a real message and inspect its authentication results.
7. Document the selector owner and plan for key rotation.

Create a DKIM record in Selzy

In Selzy, open your account settings and go to Domain Authentication. Add the sending domain and obtain the generated settings. Copy the host and value exactly as shown for your account: selectors and keys are specific to the domain and service.

For supporting setup details, see how to set up email authentication in Selzy.

Add the key to DNS

Sign in to the DNS provider that hosts the domain’s authoritative records. If you are unsure which provider is authoritative, a lookup service such as NsLookup can help identify the nameservers.

1. Create the record type specified by the sending service, usually TXT.
2. Enter the selector host, commonly in the form selector._domainkey.
3. Paste the complete value beginning with v=DKIM1.
4. Save the record and wait for cached DNS data to expire.

Long public keys may be displayed as multiple quoted strings by a DNS provider. That can be valid when DNS returns them as one value. Do not manually remove key characters or publish only one segment.

How to test DKIM authentication

Use more than one check because each method proves something different.

1. Check DNS. Query selector._domainkey.example.com to confirm the expected public key is visible. Tools such as MxToolbox and DKIMCore can validate record syntax.
2. Check the sending platform. Confirm that the domain and selector show a verified or enabled status.
3. Check a real message. Send to a mailbox you control and inspect the full headers for DKIM-Signature and Authentication-Results.

A DNS lookup proves that the key is published, but it does not prove that outgoing messages are being signed. A real message should normally show dkim=pass. Also confirm that the header.d domain aligns with the visible From domain when DMARC is in scope.

In Gmail, open the message menu and choose Show original. Other providers expose similar options for viewing the complete source. For more detail, see our guide to email headers.

DKIM troubleshooting

A DKIM failure does not automatically send every message to spam. The receiver combines authentication results with DMARC policy, reputation, content, and local rules. Legitimate intermediaries can also modify a message and break a signature.

DKIM setup checklist

• Inventory every service that sends with the domain.
• Enable DKIM separately for each sender.
• Use 2048-bit keys where supported.
• Publish the exact selector host and complete public key.
• Test DNS and a real signed message.
• Confirm DKIM alignment for DMARC.
• Monitor authentication failures and DMARC reports.
• Document key owners and rotate keys periodically.
• Use DKIM together with SPF and DMARC.

DKIM is most effective as part of a maintained authentication system. Review the setup whenever you add or remove a sending platform, and keep DNS and private-key access limited to the people and services that need it.