[ Quick answer ]
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. The sending server signs with a private key, and receivers verify it using a public key published in DNS at selector._domainkey.yourdomain.com. It proves the message came from your domain and was not altered (RFC 6376).
Key facts
- ›Public key published as a TXT (or CNAME) record at <selector>._domainkey.<domain>.
- ›Use RSA keys of at least 2048 bits; 1024-bit keys are considered weak.
- ›A domain can have many selectors, one per sending service.
- ›The d= domain in the signature must align with From for DMARC.
- ›Rotate keys periodically by publishing a new selector.
Reviewed 2026-11-02 · EmailAuth research team
DKIM (DomainKeys Identified Mail) is an email authentication standard that attaches a cryptographic signature to every message a domain sends. The receiving server uses a public key published in your DNS to verify that signature. If it checks out, the receiver knows the message was authorized by your domain and that key parts of it were not altered on the way. DKIM works with SPF and DMARC to prove your mail is genuine and to keep spoofed messages out of inboxes.
How DKIM works
DKIM uses a public and private key pair. Your sending server holds the private key and signs each outgoing message with it. The matching public key lives in a DNS TXT record at a location built from your selector, such as selector1._domainkey.example.com. When a receiver gets your message, it reads the selector and domain from the DKIM-Signature header, fetches the public key from DNS, and confirms the signature. A valid signature means the mail was signed by a party that holds your private key and that the signed content was not changed in transit.
- Private key: stored on your sending platform and never shared; it produces the signature.
- Public key: published in DNS at the selector so any receiver can verify.
- Selector: a label that lets you run several keys at once, for example one per sending service.
- Signature: the DKIM-Signature header added to the message body and select headers.
What the signature covers
DKIM signs a hash of the message body plus a chosen set of headers, commonly From, Subject, Date, and To. If any signed field changes after sending, the hash no longer matches and verification fails. This is why DKIM detects tampering. It does not encrypt the message; it proves origin and integrity, not confidentiality.
DKIM alignment and DMARC
A passing DKIM signature is only half the story for DMARC. DMARC also checks alignment, meaning the domain in the DKIM signature (the d= tag) must match the domain in the visible From address. When the signing domain and the From domain line up, DKIM is aligned and can satisfy DMARC. SPF offers a second path to alignment, so most senders configure both. Getting at least one aligned is what lets you move DMARC from monitoring to enforcement.
What a DKIM record looks like
selector1._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..." where v is the version, k is the key type, and p is the public key.
Why DKIM matters now
In 2024 Google and Yahoo began requiring bulk senders to authenticate with SPF, DKIM, and DMARC. Mail that fails these checks can be throttled or rejected. DKIM also survives forwarding better than SPF, because a forwarded message keeps its signature even when the sending IP changes, as long as the signed content stays intact. Strong DKIM is now a baseline for reaching the inbox at scale.
Keeping DKIM healthy
Use 2048-bit RSA keys where your DNS and platform allow it, since 1024-bit keys are weaker and some receivers treat them with suspicion. Rotate keys on a schedule, and retire selectors you no longer use. EmailAuth monitors your active selectors, flags weak or stale keys, and shows whether DKIM is aligned for DMARC. A free domain scan reports your active selectors, key strength, and alignment in one pass so you can fix gaps before receivers do.
Frequently asked questions
Does DKIM encrypt my email?
No. DKIM adds a cryptographic signature that proves the message came from your domain and was not altered in transit. It protects origin and integrity, not confidentiality. The message body itself is still readable to anyone who intercepts it unless you use separate transport encryption.
What is a DKIM selector?
A selector is a label that points to a specific public key in your DNS. It lets you publish several DKIM keys at once, for example a different one for each sending service. The receiver reads the selector from the DKIM-Signature header and uses it to find the right public key at selector._domainkey.yourdomain.com.
Do I need DKIM if I already have SPF?
Yes. SPF and DKIM check different things, and DMARC can align on either one. DKIM survives forwarding better than SPF, so having both gives you a stronger path to DMARC alignment. Google and Yahoo now expect bulk senders to use SPF, DKIM, and DMARC together.
How often should I rotate DKIM keys?
A common practice is rotating keys every six to twelve months, and sooner if you suspect a key was exposed. Rotation limits the damage from a leaked private key. EmailAuth flags stale keys so you know when a selector is overdue for a refresh.
What is DKIM in email?
It is a digital signature added to message headers that lets receivers verify the sending domain and that the content was not changed in transit.
How does DKIM work?
The sender hashes selected headers and the body, signs the hash with a private key and adds a DKIM-Signature header. The receiver fetches the public key from DNS using the selector and verifies the signature.
Can you have multiple DKIM records?
Yes, one per selector. Each sending service usually gets its own selector and key.
How do I set up DKIM?
Enable DKIM in each sending service, publish the TXT or CNAME record it gives you, then verify with a DKIM lookup.
[ DKIM guide ]