What is DKIM?

DKIM uses a key pair. The private key stays on the sending server and signs each message; the public key sits in your DNS where anyone can use it to check the signature. Only the holder of the private key can produce a signature that verifies.

1. 1

   The sending server signs the email

   It hashes the body and selected headers (from, subject, date) and signs the result with your private key.
2. 2

   The signature goes in the headers

   It is added as a DKIM-Signature header, which names your domain and the selector of the key used.
3. 3

   The receiving server verifies

   It fetches your public key from DNS, recomputes the hashes and checks them against the signature.
4. 4

   Pass or fail

   A match passes DKIM and builds trust in your domain. A missing or failed signature can send the message to spam.

A DKIM record is a TXT record that holds your public key. It lives under a selector, not at the root of your domain.

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3QEKyU1fSma0axspqYK5iAj+54lsAg4qRRCnpKK68hawSJ...

The selector lets one domain have several keys: one per sending service, or a new one while you rotate the old one out. Each signature names its selector, so the receiver knows which record to fetch.

The signature is a header on every message you send. You can see it in the raw source of any email.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=acme.com; s=s1;
  h=from:subject:date:message-id:to;
  bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;
  b=GJwP3Qr8KqKKKNT5HL8j3fjXvLEm9KmZs6YdO2KqEqr...

• Stops spoofing

  Nobody can produce a valid signature for your domain without your private key.

• Helps you reach the inbox

  Gmail, Outlook and Yahoo use a valid signature as a trust signal.

• Protects your brand

  Phishing that uses your domain is easier for inboxes to catch.

• Needed for DMARC

  DMARC builds on DKIM and SPF results.

Both are authentication checks, but they look at different things. Use both: each covers a case the other misses.

SPF catches mail from servers you never listed; DKIM keeps forwarded mail authenticated where SPF breaks. Read the SPF guide for the other half.

1. 1

   Generate a key pair

   Most email providers create the keys for you when you add a domain. Use 2048-bit keys where you can.
2. 2

   Publish the public key

   Add the record your provider gives you at selector._domainkey.yourdomain.com. Some providers, Plunk included, give you CNAME records that point to keys they host, so they can rotate them for you.
3. 3

   Sign outgoing email

   Your provider signs every message with the private key once the record is in place.
4. 4

   Check it

   Look up your selector with the DKIM checker to confirm the key is published and valid.

1. 1

   Send yourself a test and open the original

   In Gmail, open the message, click the three-dot menu and choose Show original. The summary at the top says whether DKIM passed.
2. 2

   Read the headers

   The Authentication-Results header shows the verdict per check. Paste raw headers into the email header analyzer to read them more easily.

   Copy

   Authentication-Results: mx.google.com;
     dkim=pass header.i=@acme.com header.s=s1 header.b=GJwP3Qr8;
     spf=pass (google.com: domain of billing@acme.com designates 54.240.8.1 as permitted sender);
     dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=acme.com

3. 3

   Query DNS

   Confirm the public key is published under the right selector.

   Copy

   dig TXT s1._domainkey.acme.com

If DKIM fails, check that:

• The record uses the selector your provider signs with.
• Your DNS provider has not truncated the key. Long keys sometimes need to be split into several strings.
• DNS has propagated, which can take up to 48 hours.
• Your email service signs with the private key that matches the published record.

• Use 2048-bit keys

  1024-bit keys still work, but Gmail and others recommend 2048.

• Set up SPF and DMARC too

  The three work together. DKIM alone does not tell inboxes what to do with forged mail.

• Monitor results

  Check that signatures keep passing, especially after DNS or provider changes.

• Rotate keys every 6 to 12 months

  Publish the new selector before you switch, and remove the old one after.

• Share your private key

  Treat it like a password. Anyone who has it can sign as you.

• Reuse a key across domains

  Give each domain its own key pair.