Key takeaways
- DKIM signs every outgoing email with a private key. Receivers check the signature with a public key in your DNS.
- A pass proves the email really came from your domain and was not changed on the way.
- Unlike SPF, DKIM usually survives forwarding, and it is required for DMARC to work reliably.
- Use 2048-bit keys, sign every service that sends as your domain, and test with Gmail’s “Show original”.
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to each email you send. The receiving server uses the signature to confirm two things: the message was authorised by your domain, and nobody altered it in transit.
If SPF is the guest list at the door, DKIM is the tamper-proof seal on the envelope.
How DKIM works
DKIM uses public-key cryptography, the same idea that secures HTTPS websites.
- Your email provider generates a key pair. The private key stays on the mail server. The public key is published in your DNS.
- When you send a message, the server creates a
DKIM-Signatureheader by signing key parts of the email (such as From, Subject and the body) with the private key. - The header includes your domain (
d=) and a selector (s=) that says which key was used. - The receiving server looks up
selector._domainkey.yourdomain.comin DNS and gets the public key. - It verifies the signature. If the content or headers were changed, or the key does not match, DKIM fails.
What a DKIM record looks like
google._domainkey.yourcompany.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."googleis the selector. Each sending service uses its own selector, so you can have several DKIM keys at once.v=DKIM1marks the record as DKIM.k=rsais the key type.p=is the public key itself.
How to set up DKIM on popular platforms
| Platform | Where to switch it on | DNS record type |
|---|---|---|
| Google Workspace | Admin console → Apps → Gmail → Authenticate email | One TXT record (selector usually google) |
| Microsoft 365 | Microsoft Defender portal → Email authentication settings → DKIM | Two CNAME records (selector1, selector2) |
| cPanel hosted email | cPanel → Email Deliverability | One TXT record (selector default) |
| Zoho Mail | Admin console → Domains → Email configuration → DKIM | One TXT record |
| Marketing / CRM tools | The tool’s domain authentication settings | Usually CNAME records |
After adding the DNS record, go back to the platform and click Start authentication or Enable. DNS changes can take from a few minutes up to 48 hours to be visible everywhere.
Pro tip: Microsoft 365 uses two selectors so it can rotate keys automatically. Always publish both CNAME records, or signing will fail when Microsoft switches keys.
Why DKIM matters for your business
- Stops spoofing and invoice fraud. Attackers cannot produce a valid signature for your domain without your private key.
- Survives forwarding. When a client forwards your email, SPF often breaks, but the DKIM signature usually stays valid.
- Improves deliverability. Gmail, Yahoo and Outlook trust authenticated senders more and require authentication from business senders.
- Makes DMARC work. DMARC needs SPF or DKIM to pass and match the visible From domain. DKIM is the more reliable of the two.
DKIM best practices
- Use 2048-bit keys wherever your provider supports them. 1024-bit keys are now considered weak.
- Sign mail from every service that sends as your domain: website forms, billing, CRM and newsletters.
- Rotate keys periodically and delete selectors you no longer use.
- Avoid the
l=(body length) tag, which can let attackers append content to a signed message. - Add a DMARC record and read its reports to catch any unsigned senders.
How to test that DKIM is working
- Send an email from your domain to a Gmail address.
- Open it, click the three dots, and choose Show original.
- Look for
DKIM: 'PASS' with domain yourcompany.com. - If it shows FAIL or is missing, check the selector name, that the record was copied without line breaks, and that signing is switched on in your platform.
DKIM vs SPF vs DMARC
| SPF | DKIM | DMARC | |
|---|---|---|---|
| Checks | Sending server IP | Cryptographic signature | Alignment with the From domain |
| Survives forwarding | Usually not | Usually yes | Depends on SPF/DKIM |
| Stops display-name spoofing | No | No | Yes, with p=quarantine or p=reject |
| Gives you reports | No | No | Yes |
Frequently asked questions
Do I need both SPF and DKIM?
Yes. They protect different parts of the message, and together with DMARC they give the strongest protection and the best inbox placement.
What is a DKIM selector?
It is a label that tells receivers which public key to look up. It lets you run several keys at once, for example one for Microsoft 365 and one for your newsletter tool.
Why does DKIM fail after I set it up?
The most common causes are a typo or line break in the DNS record, the wrong selector name, DNS not yet updated, or signing not switched on in the email platform.
Should I use 1024-bit or 2048-bit DKIM keys?
Use 2048-bit keys. Some old DNS panels limit record length, in which case the key is split into two quoted strings in one TXT record.
Does DKIM encrypt my emails?
No. DKIM signs emails to prove where they came from. It does not hide the content. Use TLS for encryption in transit.
Let us set up DKIM for you
Altn Technology configures DKIM, SPF and DMARC for Google Workspace, Microsoft 365, Zoho and hosted email, and fixes deliverability problems for businesses across India. Explore our corporate email services or request a free quote.
