A DKIM record is a DNS record that publishes the public key receivers use to check the digital signature on your email. When your server or sending service signs an outgoing message with a private key, the receiving server looks up the matching public key in your DNS, verifies the signature and learns two things: the message really was authorised by the domain that signed it, and its signed parts were not altered on the way. DKIM is one of the three pillars of email authentication, and it is the most reliable of them when mail is forwarded. This guide explains what a DKIM record is, what one looks like, how to create it, where to publish it, how to test and check it and how to fix the usual problems.
What is a DKIM record?
DKIM stands for DomainKeys Identified Mail. It works with a pair of cryptographic keys. The private key lives on the system that sends your mail and is used to create a signature, which is added to each message as a header called DKIM-Signature. The public key is published in your DNS so that anyone can use it to verify the signature. The DNS entry that holds the public key is the DKIM record.
Because the signature covers parts of the message, a receiver can detect tampering. And because the signature belongs to the message and not to the connecting server, it can survive forwarding in many cases, unlike SPF. See email forwarding explained.
What does a DKIM record look like?
The record is published under a name made of a selector, the label _domainkey and your domain:
Name: s1._domainkey.example.com Type: TXT Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
The long value after p= is the public key, shown here shortened. The parts mean:
| Part | Meaning |
|---|---|
s1 (the selector) | A name you or your provider choose. It lets a domain publish several keys at once, one per sending system or per rotation. |
_domainkey | A fixed label that marks the name as holding DKIM keys. |
v=DKIM1 | Version tag. Optional but common. |
k=rsa | Key type. RSA is the common one. |
p=... | The public key, encoded in base 64. An empty value revokes the key. |
Many sending services ask you to publish a CNAME record instead. The CNAME points your selector name to a name on the provider's domain, where the real key lives. This lets the provider rotate keys for you without a DNS change on your side.
What does a DKIM signature in a message look like?
If you open the headers of a signed message, you will see something like this, shortened:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s1; h=from:to:subject:date:message-id; bh=...; b=...
The d= value is the signing domain and s= is the selector. A receiver builds the DNS name s1._domainkey.example.com from them, fetches the key and checks the signature in b=. For DMARC to count the result, the d= domain must align with the From domain. See DMARC alignment explained.
How to create a DKIM record
If you use a sending service or mailbox provider
- Open the domain or authentication settings of your account and choose to set up DKIM for your domain.
- The service shows you the record or records to publish: the host name (including the selector) and the value. Copy them exactly.
- Add them in your DNS panel. A TXT record carries the key itself; a CNAME record points to the provider's key.
- Return to the service and click the verify button, or wait for it to detect the record.
- Once verified, make sure signing is turned on.
With MigoSMTP, the exact records are shown in your domain settings in the dashboard. Copy them from there. Our guide to authenticating your sending domain shows how SPF, DKIM and DMARC fit together.
If you run your own mail server
- Generate a key pair with the tool your mail software provides, or with OpenSSL. Use a 2048-bit RSA key where your DNS provider allows it; 1024-bit keys are the older minimum and are weaker.
- Keep the private key on the server, readable only by the mail software.
- Publish the public key as a TXT record at
selector._domainkey.yourdomain. - Configure the server to sign outgoing mail with the private key and selector.
- Send a test message and check the signature.
Some DNS panels limit the length of a single TXT string, and a 2048-bit key exceeds 255 characters. DNS handles this by storing several quoted strings in one record. Most panels split the value for you. If yours does not, enter it in parts as your provider describes.
Where do I publish the DKIM record?
In the DNS zone of the domain used in the d= tag, which is normally the domain you send from. In many DNS panels you type only the part before your domain, for example s1._domainkey, and the panel adds the rest. Check the panel's help if you are unsure, because adding the domain twice is a common mistake that produces a record at the wrong name.
How to check a DKIM record
With a checker
Enter your domain and selector in our SPF, DKIM and DMARC checker. It fetches the record and tells you whether it is present and well formed.
From the command line
dig +short TXT s1._domainkey.example.com nslookup -type=TXT s1._domainkey.example.com
If the record is a CNAME, the answer shows the target name and then the key. You need to know the selector to check, and you can find it in the s= tag of a signed message.
From a real message
Send a message to a mailbox you control. Open the original message or the headers and look at the authentication results for dkim=pass. If it says dkim=fail or dkim=none, read the reason that follows. See how to read email headers.
How to test DKIM
- Send a test message from each system that sends for your domain: your mailbox provider, your marketing platform, your application.
- Check the headers of each for
dkim=passand note thed=domain. - Confirm that
d=matches your From domain, for DMARC alignment. - Try a message that passes through a forwarder or mailing list if forwarding matters to you.
Common DKIM problems and fixes
| Problem | Likely cause | Fix |
|---|---|---|
| No DKIM record found | Wrong selector or host name, record not published or DNS not updated | Check the selector in a signed message and the exact record name |
| dkim=fail, body hash did not verify | The message was changed after signing, for example by a footer added by a gateway or list | Move the signing to the last hop or stop the modification |
| dkim=fail, signature did not verify | Wrong public key, record truncated or private key mismatch | Republish the key exactly as generated |
| Key too long for DNS panel | String limit of 255 characters | Enter the value in several quoted parts, or use the provider's CNAME |
| dkim=pass but DMARC fails | d= domain does not align with the From domain | Sign with your own domain, not the provider's default domain |
| Record copied with quotes or extra spaces | Pasting from a document | Paste as plain text and compare character by character |
Key length and rotation
Keys should be changed from time to time, and weak keys should be replaced. Publish the new key under a new selector, switch signing to it, keep the old record for a while so that messages in transit still verify, then remove the old one. Providers that use CNAMEs often do this automatically. For the procedure, see DKIM key rotation, selectors and key length.
DKIM, SPF and DMARC together
DKIM proves that the signing domain authorised the message. SPF proves that the sending server is allowed to send for the envelope domain. DMARC tells receivers what to do when neither lines up with the From address. You need all three for reliable delivery to large mailbox providers. Next steps: SPF record explained and DMARC record syntax and setup.
Verify your DKIM record Enter your domain and selector to see whether your key is published and valid.
References and further reading
Frequently asked questions
What is a DKIM record?
A DNS record at selector._domainkey.yourdomain that publishes the public key receivers use to verify the DKIM signature on your email.
What is a DKIM selector?
A name that identifies which key to use. It lets a domain publish several keys at once, for different sending systems or for key rotation.
How do I check my DKIM record?
Use a DKIM checker with your domain and selector, run dig +short TXT selector._domainkey.yourdomain, or look for dkim=pass in the headers of a test message.
Why does DKIM fail?
Common causes are a missing or wrong record, a mistyped selector, a message modified after signing, a truncated key or a signing domain that does not align with the From domain.
How long should a DKIM key be?
Use 2048-bit RSA where your DNS provider allows it. 1024-bit keys are weaker. Rotate keys from time to time using new selectors.