What Is a DKIM Record?

TL;DR
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server looks up a public key in your DNS to verify the signature — proving the email genuinely came from your domain and wasn't tampered with in transit.
Unlike SPF (which checks the sending IP), DKIM signatures travel with the message and survive email forwarding.

How DKIM Works

1. Your mail server signs each outgoing message using a private key you control.
2. The signature is added to the email as a DKIM-Signature header.
3. The receiving server reads the d= (domain) and s= (selector) values from the signature.
4. It queries DNS for the public key at {selector}._domainkey.{domain} as a TXT record.
5. It uses the public key to verify the signature against the message content.
6. If the signature is valid, DKIM passes — the email is authenticated.

The private key lives on your mail server (or your ESP's servers). The public key is published in DNS. They are mathematically paired — you can verify with the public key but only sign with the private key.

Where DKIM Records Live

DKIM records are published at a selector-based subdomain:

{selector}._domainkey.{domain}

For example, if your selector is google and your domain is example.com:

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

Selectors allow a domain to have multiple DKIM keys simultaneously — useful when you use several email providers or want to rotate keys without downtime.

DKIM Record Format

{selector}._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=<public-key>"

Key Tags

Common DKIM Records by Provider

Google Workspace (selector: google)

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."

Google generates the key pair for you — you copy the public key from the Admin Console and add it to DNS.

Microsoft 365 (selectors: selector1, selector2)

selector1._domainkey.example.com.  CNAME  selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey.example.com.  CNAME  selector2-example-com._domainkey.example.onmicrosoft.com.

Microsoft 365 uses CNAME records that point back to Microsoft-managed keys, allowing automatic key rotation.

Mailchimp (selector: k1 or k2)

k1._domainkey.example.com.  CNAME  dkim.mcsv.net.

Sendgrid (selector: s1, s2, or custom)

s1._domainkey.example.com.  CNAME  s1.domainkey.u12345.wl012.sendgrid.net.

How to Find Your DKIM Selector

The selector is in the DKIM-Signature header of any email your domain sends. To find it:

1. Send yourself a test email from your domain
2. View the raw message headers (Gmail: "Show original", Outlook: "View message source")
3. Look for the DKIM-Signature header
4. Find the s= tag — that's your selector

Example header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=example.com; s=google;
  h=from:to:subject:date;
  bh=base64hash; b=base64signature

Here s=google means the selector is google and the record lives at google._domainkey.example.com.

How to Look Up a DKIM Record

dig google._domainkey.example.com TXT

nslookup -type=TXT google._domainkey.example.com

Replace google with your actual selector and example.com with your domain.

RSA vs Ed25519

Most providers generate RSA keys. Ed25519 is smaller and more secure but has limited receiver support. Running both is possible using different selectors.

DKIM and Forwarding

DKIM survives email forwarding because the signature travels with the message headers. SPF breaks on forwarding (the forwarding server's IP is not in the original SPF record). This makes DKIM the more reliable authentication method for DMARC alignment when forwarding is involved.

SPF vs DKIM vs DMARC

→ See also: SPF Record, DMARC Record, TXT Record

Frequently Asked Questions

References

Related: SPF Record · DMARC Record · MX Record · TXT Record