TL;DR
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server looks up a public key in your DNS to verify the signature — proving the email genuinely came from your domain and wasn't tampered with in transit.
Unlike SPF (which checks the sending IP), DKIM signatures travel with the message and survive email forwarding.
DKIM-Signature header.d= (domain) and s= (selector) values from the signature.{selector}._domainkey.{domain} as a TXT record.The private key lives on your mail server (or your ESP's servers). The public key is published in DNS. They are mathematically paired — you can verify with the public key but only sign with the private key.
DKIM records are published at a selector-based subdomain:
{selector}._domainkey.{domain}For example, if your selector is google and your domain is example.com:
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."Selectors allow a domain to have multiple DKIM keys simultaneously — useful when you use several email providers or want to rotate keys without downtime.
{selector}._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=<public-key>"| Tag | Required | Description |
|---|---|---|
v=DKIM1 | Yes | Version — always DKIM1 |
k=rsa | No (default) | Key type — rsa (most common) or ed25519 |
p=<key> | Yes | Base64-encoded public key. Empty value (p=) revokes the key |
s=email | No | Service type — * or email |
t=s | No | Flags — s means subdomains are not covered |
h=sha256 | No | Acceptable hash algorithms |
n=<notes> | No | Human-readable notes (ignored by verifiers) |
Google Workspace (selector: google)
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."Google generates the key pair for you — you copy the public key from the Admin Console and add it to DNS.
Microsoft 365 (selectors: selector1, selector2)
selector1._domainkey.example.com. CNAME selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey.example.com. CNAME selector2-example-com._domainkey.example.onmicrosoft.com.Microsoft 365 uses CNAME records that point back to Microsoft-managed keys, allowing automatic key rotation.
Mailchimp (selector: k1 or k2)
k1._domainkey.example.com. CNAME dkim.mcsv.net.Sendgrid (selector: s1, s2, or custom)
s1._domainkey.example.com. CNAME s1.domainkey.u12345.wl012.sendgrid.net.The selector is in the DKIM-Signature header of any email your domain sends. To find it:
DKIM-Signature headers= tag — that's your selectorExample header:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=example.com; s=google;
h=from:to:subject:date;
bh=base64hash; b=base64signatureHere s=google means the selector is google and the record lives at google._domainkey.example.com.
dig google._domainkey.example.com TXTnslookup -type=TXT google._domainkey.example.comReplace google with your actual selector and example.com with your domain.
| Feature | RSA (2048-bit) | Ed25519 |
|---|---|---|
| Key size | ~300 chars (base64) | ~68 chars (base64) |
| Compatibility | Universal | Not supported by all receivers |
| Security | Strong | Stronger per bit |
| DNS record size | Often requires chunking | Fits in one string |
| Recommended | Yes (for compatibility) | Yes (as supplementary key) |
Most providers generate RSA keys. Ed25519 is smaller and more secure but has limited receiver support. Running both is possible using different selectors.
DKIM survives email forwarding because the signature travels with the message headers. SPF breaks on forwarding (the forwarding server's IP is not in the original SPF record). This makes DKIM the more reliable authentication method for DMARC alignment when forwarding is involved.
| Feature | SPF | DKIM | DMARC |
|---|---|---|---|
| What it checks | Sending server IP | Cryptographic message signature | Alignment of SPF/DKIM with From header |
| Survives forwarding | No | Yes | Depends on DKIM passing |
| Published at | example.com TXT | selector._domainkey.example.com TXT | _dmarc.example.com TXT |
| Requires private key | No | Yes | No |
| Provides reports | No | No | Yes |
→ See also: SPF Record, DMARC Record, TXT Record
Related: SPF Record · DMARC Record · MX Record · TXT Record