DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to every outgoing email. Receiving servers use the signature to confirm the email really came from your domain and was not changed on the way.
What Is DKIM?
DKIM uses a pair of cryptographic keys. Your mail server keeps a private key and signs each outgoing message. The matching public key is published in your domain’s DNS. Receivers fetch the public key and verify the signature. If the message or key does not match, the check fails.
How DKIM Works
- Your email service creates a key pair and gives you a DNS record to publish.
- When you send an email, the server adds a
DKIM-Signatureheader, signed with the private key. - The header includes your domain (
d=) and a selector (s=) that says which key was used. - The receiving server looks up
selector._domainkey.yourdomain.comin DNS to get the public key. - It verifies the signature. A pass shows the email is genuine and unaltered.
DKIM Record Example
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
Google Workspace provides a TXT record (usually with the selector google), while Microsoft 365 uses two CNAME records (selector1 and selector2) that point to Microsoft-managed keys.
Why DKIM Matters
- Stops spoofing: attackers cannot sign emails without your private key.
- Survives forwarding: unlike SPF, a DKIM signature usually stays valid when email is forwarded.
- Improves deliverability: authenticated mail is trusted more by Gmail, Outlook and Yahoo.
- Required for DMARC: DMARC needs SPF or DKIM to pass and align with your From domain.
DKIM Best Practices
- Use 2048-bit keys where your provider supports them.
- Enable DKIM for every service that sends as your domain, including marketing and billing tools.
- Rotate keys periodically and remove old selectors you no longer use.
- Add a DMARC record to monitor results and protect your domain.
Frequently Asked Questions
Do I need both SPF and DKIM?
Yes. They protect different parts of the message, and together with DMARC they give the strongest protection and best deliverability.
How do I know DKIM is working?
Send an email to a Gmail account, open it and choose “Show original”. The DKIM line should say PASS with your domain.
Need Help Setting This Up?
Altn Technology sets up and manages business email and security for companies in Panipat, Karnal, Ambala, Chandigarh, Mohali, Baddi and across India. Request a quote or call +91 180 407 8502.