What is DKIM?

The problem DKIM solves

When an email travels from your mail server to someone's inbox, it passes through several servers along the way. Any of those could theoretically modify the content — changing a bank account number in an invoice, for example. DKIM makes that tampering detectable.

It also helps receiving servers trust that your email is genuine, which directly improves your chances of landing in the inbox rather than spam.

How DKIM works (simply)

Think of it like a padlock and key:

• Your mail server has a private key — kept secret, used to sign every outgoing email
• You publish a public key in your DNS — anyone can read it
• When a receiving server gets your email, it uses the public key to verify the signature
• If the signature checks out, the email hasn't been tampered with and really came from your server

You never need to manage the keys yourself. When you configure DKIM in Google Workspace, Microsoft 365, or your email sending service, they handle the signing and give you the DNS record to publish.

What is a DKIM selector?

A selector is just a name that identifies which DKIM key to use. You might have multiple keys — one for your main mail server and one for a bulk email service — and selectors keep them separate.

The DNS record for a DKIM key lives at:

[selector]._domainkey.yourdomain.com

Common selectors are google, selector1, k1, ormail. Your provider will tell you which one to use. If you're not sure, look at the raw headers of an email you sent — find the line starting withDKIM-Signature: and look for s=.

DKIM vs SPF — what's the difference?

• SPF says which servers are allowed to send as your domain — it's about the sending IP
• DKIM signs the actual message content — it's about the email itself

You need both. SPF can be fooled by mail forwarding (the forwarding server's IP isn't in your SPF record). DKIM survives forwarding because the signature travels with the email. DMARC requires at least one of them to pass.

What happens without DKIM?

• Your DMARC policy can't be enforced if SPF also fails (common when email is forwarded)
• Gmail, Outlook, and Yahoo are more likely to route your emails to spam
• You can't enable BIMI (the feature that shows your brand logo in inboxes)

How to set up DKIM

Go to your mail provider's settings and look for "DKIM" or "Email authentication". They'll generate a key pair and give you a TXT record to add to your DNS. The record looks like:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...

Paste that into a TXT record at [selector]._domainkey.yourdomain.com and you're done. Changes take effect within minutes to an hour as DNS propagates.