DKIMEmail authentication explained

What is DKIM?

DKIM (DomainKeys Identified Mail) signs every outgoing message with a private key and publishes the matching public key in DNS at <selector>._domainkey.<domain>. The receiving server reads the selector and domain from the DKIM-Signature header, fetches the key and checks that the signed headers and body arrived unchanged. A pass proves the domain in d= sent the message.

How it looks in DNS

TXT

Name: google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu...IDAQAB

Google Workspace's default selector with a 2048-bit RSA key (shortened); the signing server keeps the private half

Part by part

The DKIM record taken apart

The example above, left to right. Every part is something a receiving server reads.

TXT at google._domainkey

google._domainkeyv=DKIM1k=rsap=MIIBIjAN…IDAQAB

google._domainkeyWhere the key lives: the selector (google), then _domainkey, under your domain. Each sending service has its own selector
v=DKIM1Version of the key record. Recommended; if present it must come first
k=rsaKey type. rsa is the default; ed25519 is the newer, shorter alternative from RFC 8463
p=MIIBIjAN…IDAQABThe public key, base64. An empty p= means the key is revoked and every signature with this selector fails

Look up the DKIM record of any domain

The same check as our DKIM checker: the record is read live from DNS in your browser and every part is explained. Try your own domain, or a big sender to see a working record.

Try

Without a selector the checker tries the ones providers document and other common names. Lookups go from your browser to Cloudflare's public DNS resolver.

Selectors Google, Microsoft, SendGrid and others document
Key length read from the published key
Who hosts each key, from its CNAME
Where to generate a new key for your provider

How it works

How a DKIM signature is made and checked

The sender signssource (opens the vendor's page in a new tab)
The sending server hashes the body (bh=), signs the chosen headers with its private key (b=) and adds a DKIM-Signature header naming the domain (d=) and the selector (s=)
The receiver finds the keysource (opens the vendor's page in a new tab)
It queries TXT at <s>._domainkey.<d>, such as selector1._domainkey.example.com
It checks the hashessource (opens the vendor's page in a new tab)
It normalises the headers and body (simple or relaxed canonicalization), recomputes the body hash and verifies the signature with the public key
It records the resultsource (opens the vendor's page in a new tab)
dkim=pass, fail, or neutral and temperror when the key is missing or DNS fails; a message can carry several signatures
DMARC checks the domainsource (opens the vendor's page in a new tab)
A DKIM pass counts for DMARC when d= matches the From domain: the same organizational domain (relaxed) or the exact name (strict)

DKIM is the record that survives forwarding. SPF breaks when a message is relayed, because the forwarding server is not on your list; a DKIM signature still verifies as long as the signed headers and body are intact. That makes an aligned DKIM signature the most reliable way to pass DMARC.

You rarely write the key yourself. Each sending service generates it and either shows a TXT value to paste or asks for CNAME records that point to a key it hosts and rotates (Microsoft 365, SendGrid, Mailchimp, Amazon SES). The selector is how several services sign for the same domain without clashing: Microsoft 365 uses selector1 and selector2, Google Workspace uses google, Postmark a timestamp ending in pm.

A DKIM checker needs the selector, because DNS cannot list every name under _domainkey. The DKIM checker tries the selectors of common providers; the selector of any message is in its DKIM-Signature header as s=.

Reference

DKIM-Signature header tags

v=Required:YesVersion, always 1
a=Required:YesSigning algorithm: rsa-sha256, or ed25519-sha256 (RFC 8463); rsa-sha1 must no longer be used
d=Required:YesThe signing domain; DMARC compares it with the From domain
s=Required:YesThe selector: the key is at <s>._domainkey.<d>
h=Required:YesThe signed header fields, colon-separated; From must be one of them
bh=Required:YesHash of the canonicalized body
b=Required:YesThe signature itself, base64
c=Required:NoCanonicalization for header/body: simple (default) or relaxed, which tolerates whitespace changes
l=Required:NoBody length signed; risky, because content appended after it is not covered
t= / x=Required:NoSigning time and expiry

Sourcesource (opens the vendor's page in a new tab)

Rules and limits

What receivers enforce on DKIM

rsa-sha1 must not be used; RSA keys must be at least 1024 bits and should be 2048, and verifiers must reject keys under 1024source (opens the vendor's page in a new tab)
Gmail asks for a DKIM key of 1024 bits or longer from senders to personal accounts and recommends 2048source (opens the vendor's page in a new tab)
Senders of 5,000+ messages a day to Gmail need DKIM and SPF, plus DMARC, with the From domain alignedsource (opens the vendor's page in a new tab)
The From header must be signedsource (opens the vendor's page in a new tab)
Selectors let a domain publish several keys at once, so a new key can go live before the old one is removedsource (opens the vendor's page in a new tab)
Ed25519 keys (k=ed25519) are standard since RFC 8463; signers can add an RSA and an Ed25519 signature to the same messagesource (opens the vendor's page in a new tab)
An empty p= tag in the key record means the key is revokedsource (opens the vendor's page in a new tab)
The optional l= tag signs only the first part of the body, so text appended after it still verifies; leave it outsource (opens the vendor's page in a new tab)

By provider

The DKIM record for each sending service

The values from each provider's own docs. Open a provider for the full records, the steps in its interface and a check pre-set for it.

Where the record goes

What to type in each field of your DNS panel:

Troubleshooting

Common DKIM errors and fixes

dkim=neutral or no key found
The record is missing at <selector>._domainkey, or the name carries the domain twice (google._domainkey.example.com.example.com); enter the host without the domainsource (opens the vendor's page in a new tab)
dkim=fail, body hash did not verify
Something changed the body after signing: a footer added by a gateway or mailing list, or a link rewriter. Sign after those systems, or let the last hop signsource (opens the vendor's page in a new tab)
Key truncated in DNS
A 2048-bit key is longer than 255 characters; paste it whole as one TXT record (split into quoted strings if the host requires it)source (opens the vendor's page in a new tab)
DKIM passes but DMARC fails
d= is the provider's domain; turn on custom DKIM for your domain in the provider so d= matches Fromsource (opens the vendor's page in a new tab)
1024-bit key flagged
Regenerate a 2048-bit key in the provider and publish it under a new selector, then retire the old onesource (opens the vendor's page in a new tab)
Old key still published
Publish an empty p= on the retired selector, or delete it, once nothing signs with itsource (opens the vendor's page in a new tab)

For cold email

Mailboxes that come with the DNS records done

Outreach2day buys the domains, publishes SPF, DKIM and DMARC, creates the mailboxes and starts warmup, then sends your campaigns from its own sequencer or exports the mailboxes to Instantly or Smartlead.

Create mailboxes Book a call

SPF, DKIM and DMARC set for youOn every domain, checked after setup and kept in place
$2.50 a mailbox a month12-mailbox minimum; warmup and the sending engine included
1,000+ mailboxesA volume price per mailbox, quoted on a call

Questions

What does a DKIM record look like?

A TXT record at <selector>._domainkey.<domain> with a value such as v=DKIM1; k=rsa; p=<public key>. Many providers instead ask for a CNAME at that name pointing to a key they host, so they can rotate it for you.

What is a DKIM selector?

The label before ._domainkey that tells a receiver which key to fetch. Each service that signs for your domain uses its own selector (google, selector1, k2, s1), so their keys never collide. It is in every signed message as s=.

Should a DKIM key be 1024 or 2048 bits?

2048. RFC 8301 says signers should use at least 2048-bit RSA keys, and Google recommends 2048. Use 1024 only if your DNS host truly cannot store the longer value.

What is the difference between DKIM and SPF?

SPF lists the servers allowed to send for the envelope domain; DKIM signs each message so the content and the signing domain can be verified. DKIM survives forwarding and SPF does not, and DMARC accepts either one if it aligns with the From domain.

How do I find the DKIM selector of a domain?

Open a message from that domain, show the original or raw headers and read s= in the DKIM-Signature header. The checker above also tries the selectors that common providers use.

Sources

The RFCs and the mailbox providers' sender rules, checked Oct 15, 2026. Where a mailbox provider's rules change, its own page is the reference.

Deliverability call

Talk to our deliverability team

Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change. Running 1,000+ mailboxes? We also quote a volume price below every vendor list price in our comparisons, warmup and sending included.

Review your domains, DNS records and current inbox placement
Size the setup: domains, mailboxes per domain and daily volume per mailbox
Plan warmup and the move from your current provider or sequencer
1,000+ mailboxes: a volume price per mailbox for your setup

Free call

See open times in your time zone and book on this page.

Or open the booking page