[ Quick answer ]
To set up DKIM, generate a key in each sending platform (or with a DKIM generator), publish the public key as a TXT or CNAME record at selector._domainkey.yourdomain.com, enable signing in the platform and confirm the signature passes with a DKIM lookup or header analysis.
Key facts
- ›Google Workspace default selector: google.
- ›Microsoft 365 uses selector1 and selector2 CNAME records.
- ›Use 2048-bit RSA keys where your DNS host allows long TXT values.
Reviewed 2026-11-02 · EmailAuth research team
Setting up DKIM takes five steps: generate a key pair, publish the public key in DNS at a selector, enable signing on your sending platform, verify that signatures pass and align with your From domain, then rotate keys on a schedule. Most email platforms generate the keys for you and give you a record to paste into DNS, so the work is mostly careful copying and verification. Once DKIM is live, it feeds into DMARC alignment alongside SPF.
Before you start
List every service that sends mail using your domain: your mailbox provider, marketing tool, helpdesk, billing system, and any others. Each one needs its own DKIM key and selector. Missing a service means its mail may fail DKIM and, once you enforce DMARC, land in spam or bounce. A domain scan helps you find senders you forgot about.
- 1
1. Generate a key pair
Create a public and private key, ideally 2048-bit RSA. Most platforms do this for you in their DKIM settings and keep the private key on their side. If you self-host, generate the pair with your mail server tooling and store the private key securely.
- 2
2. Publish the public key in DNS
Add a TXT record at selector._domainkey.yourdomain.com, using the selector your platform gives you. The value looks like v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY. If the key is long, split it into quoted strings so DNS accepts the full value.
- 3
3. Enable signing
Turn on DKIM signing in your sending platform so every outgoing message gets a DKIM-Signature header. Confirm the platform signs with the selector and domain you published.
- 4
4. Verify signatures and alignment
Send a test message to a mailbox you control and check the headers for a DKIM pass. Confirm the d= domain matches your From domain so DKIM is aligned for DMARC. A checker or domain scan confirms strength and alignment in one look.
- 5
5. Rotate keys on a schedule
Plan to replace keys every six to twelve months. Publish a new selector, switch signing to it, verify it passes, then remove the old record once no mail uses it.
Record example
s1._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ..." split across quoted strings if your DNS limits record length.
Common setup mistakes
- Pasting the key with line breaks or spaces that corrupt the value.
- Publishing at the wrong selector name so the record appears missing.
- Using a 1024-bit key when 2048-bit is available.
- Forgetting a sending service, so its mail stays unsigned.
- Enabling signing but never checking that the domain aligns with From for DMARC.
Verify, then enforce
After DKIM passes and aligns, move DMARC toward enforcement. Start at p=none to watch reports, confirm all your senders authenticate, then step up to p=quarantine and p=reject. Google and Yahoo have required bulk senders to authenticate since 2024, so a verified DKIM setup is part of reaching the inbox. EmailAuth monitors your selectors after setup, flags weak or stale keys, and confirms DKIM stays aligned as you add new senders.
Frequently asked questions
How long does DKIM take to work after I publish the record?
The DNS record needs to propagate, which usually takes minutes but can take up to a day depending on your provider and TTL. Once the public key is visible in DNS and signing is enabled, receivers can verify your mail. Send a test message and check the headers to confirm it passes.
Can I use one DKIM key for all my sending tools?
It is cleaner to give each service its own selector and key, because the private key stays on that platform. Sharing one key across tools is not practical since each platform holds its own private key. Using a selector per service also makes rotation and troubleshooting easier.
What key length should I use for DKIM?
Use 2048-bit RSA where your DNS provider and platform support it. It is stronger than the older 1024-bit standard, which some receivers now discourage. If a long key will not fit in one TXT string, split it into multiple quoted strings.
Do I still need SPF and DMARC if DKIM is set up?
Yes. DKIM proves the message was signed and unaltered, but DMARC ties authentication to your visible From domain and tells receivers what to do with failures. SPF gives a second alignment path. All three together are what Google and Yahoo expect from bulk senders.
How do I configure DKIM?
Turn on DKIM in your email platform, copy the DNS record it shows, publish it, wait for DNS to propagate and click verify or start signing.
How long does DKIM take to work?
Usually minutes to a few hours, depending on DNS propagation and your provider's TTL.
[ DKIM guide ]
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.