What Is a DKIM Record? Email Authentication Explained
· Unified DNS Team · 9 min read
What Is a DKIM Record?
A DKIM record (DomainKeys Identified Mail record) publishes a cryptographic public key in DNS that receiving mail servers use to verify email signatures. DKIM proves that an email was sent by an authorized sender and hasn't been modified in transit.
The Basics
- DKIM stands for "DomainKeys Identified Mail"
- Uses public-key cryptography to sign emails
- The private key signs outgoing emails (kept secret)
- The public key is published in DNS (for verification)
- Receiving servers verify signatures using the public key
Why DKIM Matters
DKIM provides:
- Authentication — Proves email came from an authorized sender
- Integrity — Confirms email content wasn't modified
- Non-repudiation — Sender can't deny sending the email
- Reputation building — ISPs trust domains with valid DKIM
- Phishing prevention — Makes impersonation much harder
Example DKIM Record
selector1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
How DKIM Works
The Signing Process (Sending)
- Email composed — User writes email
- Hash created — Mail server creates hash of email headers and body
- Signature generated — Hash encrypted with private key
- DKIM-Signature header added — Signature attached to email
- Email sent — Includes signature header
The Verification Process (Receiving)
- Email received — Contains DKIM-Signature header
- Selector extracted — From DKIM-Signature header
- DNS lookup — Retrieves public key from selector._domainkey.domain
- Signature decrypted — Using the public key
- Hash compared — Recalculated hash vs decrypted signature
- Result — Pass (match) or Fail (mismatch)
The Complete Flow
Sending Server:
- Create email hash
- Sign hash with private key
- Add DKIM-Signature header
- Send email
Receiving Server:
- Extract selector from DKIM-Signature header
- Query DNS for public key
- Decrypt signature using public key
- Compare hashes
- Return PASS/FAIL
Example DKIM-Signature Header
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=example.com; s=selector1;
h=from:to:subject:date:message-id;
bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD0...
| Tag | Meaning |
|---|---|
| **v** | Version (always 1) |
| **a** | Algorithm (rsa-sha256) |
| **c** | Canonicalization (relaxed/relaxed) |
| **d** | Signing domain |
| **s** | Selector |
| **h** | Signed headers |
| **bh** | Body hash |
| **b** | Signature |
DKIM Record Structure
Record Location
DKIM records are published at: selector._domainkey.domain.com
; For selector "selector1" and domain "example.com"
selector1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=..."
DKIM Record Tags
| Tag | Required | Description |
|---|---|---|
| **v** | Yes | Version (always DKIM1) |
| **k** | No | Key type (default: rsa) |
| **p** | Yes | Public key (base64 encoded) |
| **t** | No | Flags (y=testing, s=strict) |
| **h** | No | Acceptable hash algorithms |
| **s** | No | Service type (default: * = all) |
| **n** | No | Notes (human-readable) |
Example Records
Standard DKIM record:
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
Testing mode:
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; t=y; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
Key revoked (empty p=):
selector1._domainkey.example.com. TXT "v=DKIM1; p="
Setting Up DKIM
Microsoft 365
Microsoft 365 uses CNAME records instead of TXT records for easier management:
Step 1: Enable DKIM in Microsoft 365 Admin Center
Step 2: Add these CNAME records:
selector1._domainkey.example.com. CNAME selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey.example.com. CNAME selector2-example-com._domainkey.example.onmicrosoft.com.
Note: Replace "example-com" with your domain (hyphens replace dots).
Google Workspace
Step 1: Generate DKIM key in Google Admin Console
Step 2: Add the TXT record:
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
Step 3: Activate DKIM signing in Google Admin
SendGrid
s1._domainkey.example.com. CNAME s1.domainkey.u1234567.wl001.sendgrid.net.
s2._domainkey.example.com. CNAME s2.domainkey.u1234567.wl001.sendgrid.net.
Mailchimp
k1._domainkey.example.com. CNAME dkim.mcsv.net.
Custom Mail Server
Step 1: Generate key pair
# Generate private key
openssl genrsa -out dkim-private.pem 2048
# Extract public key
openssl rsa -in dkim-private.pem -pubout -out dkim-public.pem
Step 2: Configure mail server with private key
Step 3: Publish public key in DNS:
mail._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
Understanding DKIM Selectors
What Are Selectors?
Selectors allow multiple DKIM keys for the same domain:
- Different selectors for different mail systems
- Key rotation without breaking existing email
- Multiple services can each have their own key
Selector Examples
; Microsoft 365
selector1._domainkey.example.com. CNAME ...
selector2._domainkey.example.com. CNAME ...
; Google Workspace
google._domainkey.example.com. TXT ...
; SendGrid
s1._domainkey.example.com. CNAME ...
s2._domainkey.example.com. CNAME ...
; Custom server with date-based selector
202401._domainkey.example.com. TXT ...
Why Multiple Selectors?
- Multiple email services — Each service uses its own selector
- Key rotation — New key with new selector, old key remains valid during transition
- Security — If a key is compromised, only that selector needs to be revoked
Best Practices for MSPs
1. Always Enable DKIM
DKIM should be enabled for every domain that sends email:
- Microsoft 365 domains
- Google Workspace domains
- Marketing platforms
- Transactional email services
2. Use 2048-bit Keys (Self-Managed Only)
If you're managing your own DKIM keys (not using Microsoft 365, Google Workspace, or similar managed services), use at least 2048-bit RSA keys:
; 2048-bit key (recommended)
selector._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
; 1024-bit key (legacy, less secure)
; Shorter public key string
Note: Services like Microsoft 365 and Google Workspace manage key sizes automatically.
3. Plan for Key Rotation (Self-Managed Only)
If you're managing your own DKIM keys, rotate them periodically (annually is common):
- Create new key with new selector
- Publish new DKIM record
- Update mail server to sign with new key
- Keep old record for a few days (cached signatures)
- Remove old record
Note: Microsoft 365, Google Workspace, and other managed email services handle key rotation automatically.
4. Monitor DKIM with DMARC Reports
DMARC aggregate reports show DKIM pass/fail rates:
- Identify services not signing with DKIM
- Detect key issues before they cause problems
- Verify new DKIM setups are working
5. Document All DKIM Records
Track for each client domain:
- All DKIM selectors in use
- Which service uses which selector
- Key creation date
- Next rotation date
6. Use Unified DNS for DKIM Visibility
Managing DKIM across dozens of clients is complex. Unified DNS provides:
- View all DKIM records across all clients
- Monitor for missing or invalid DKIM
- Track key rotation schedules
- Sync documentation to Hudu
Troubleshooting DKIM
DKIM Verification Failing
Check if record exists:
dig TXT selector1._domainkey.example.com
Common causes:
- Wrong selector name
- DNS propagation not complete
- Record too long (needs splitting)
- Typo in public key
Finding the Correct Selector
From email headers:
Look for s= in the DKIM-Signature header:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ...
Record Length Issues
DKIM public keys are long. TXT records over 255 characters must be split:
; Automatically handled by most DNS providers
selector._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjAN" "BgkqhkiG9w0BAQEFAAOCAQ8A" "MIIBCgKCAQEA..."
Testing DKIM
Send test email to Gmail:
- Send email to a Gmail account
- Open email and click three dots → "Show original"
- Look for "DKIM: PASS"
Use command line:
# Query DKIM record
dig TXT selector1._domainkey.example.com +short
Online tools:
- mail-tester.com
- mxtoolbox.com/dkim.aspx
- dkimvalidator.com
Frequently Asked Questions
What's the difference between SPF and DKIM?
- SPF — Verifies the sending server is authorized (IP-based)
- DKIM — Verifies the email content hasn't been modified (signature-based)
Both are needed for complete email authentication.
Can I have multiple DKIM records?
Yes! Each selector creates a separate DKIM record. This is normal when using multiple email services or rotating keys.
What happens if DKIM fails?
Depending on your DMARC policy:
- p=none — Email accepted, failure logged
- p=quarantine — Email sent to spam folder
- p=reject — Email rejected
Without DMARC, receiving servers decide independently (usually accept with lower trust).
How often should I rotate DKIM keys?
Best practice is annual rotation. Some organizations rotate more frequently (quarterly) for higher security requirements.
Do I need DKIM if I have SPF?
Yes. SPF and DKIM serve different purposes:
- SPF doesn't survive email forwarding well
- DKIM provides message integrity
- DMARC requires at least one of them (ideally both)
What key size should I use?
Use 2048-bit RSA keys. 1024-bit keys are considered weak and may be rejected by some receivers. Some providers are moving to 4096-bit.
Get Started with Unified DNS
DKIM is essential for email security and deliverability. Unified DNS lets you view, modify, audit, and backup DKIM records across all your clients — with a compliance dashboard showing DKIM status for every domain and automated Hudu documentation syncing.
Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.