What Is a DKIM Record? Email Authentication Explained

What Is a DKIM Record?

A DKIM record (DomainKeys Identified Mail record) publishes a cryptographic public key in DNS that receiving mail servers use to verify email signatures. DKIM proves that an email was sent by an authorized sender and hasn’t been modified in transit.

The Basics

• DKIM stands for “DomainKeys Identified Mail”
• Uses public-key cryptography to sign emails
• The private key signs outgoing emails (kept secret)
• The public key is published in DNS (for verification)
• Receiving servers verify signatures using the public key

Why DKIM Matters

DKIM provides:

• Authentication — Proves email came from an authorized sender
• Integrity — Confirms email content wasn’t modified
• Non-repudiation — Sender can’t deny sending the email
• Reputation building — ISPs trust domains with valid DKIM
• Phishing prevention — Makes impersonation much harder

Example DKIM Record

selector1._domainkey.example.com.    3600    IN    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

How DKIM Works

The Signing Process (Sending)

1. Email composed — User writes email
2. Hash created — Mail server creates hash of email headers and body
3. Signature generated — Hash encrypted with private key
4. DKIM-Signature header added — Signature attached to email
5. Email sent — Includes signature header

The Verification Process (Receiving)

1. Email received — Contains DKIM-Signature header
2. Selector extracted — From DKIM-Signature header
3. DNS lookup — Retrieves public key from selector._domainkey.domain
4. Signature decrypted — Using the public key
5. Hash compared — Recalculated hash vs decrypted signature
6. Result — Pass (match) or Fail (mismatch)

The Complete Flow

Sending Server:

1. Create email hash
2. Sign hash with private key
3. Add DKIM-Signature header
4. Send email

Receiving Server:

1. Extract selector from DKIM-Signature header
2. Query DNS for public key
3. Decrypt signature using public key
4. Compare hashes
5. Return PASS/FAIL

Example DKIM-Signature Header

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=example.com; s=selector1;
    h=from:to:subject:date:message-id;
    bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
    b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD0...

Tag	Meaning
v	Version (always 1)
a	Algorithm (rsa-sha256)
c	Canonicalization (relaxed/relaxed)
d	Signing domain
s	Selector
h	Signed headers
bh	Body hash
b	Signature

DKIM Record Structure

Record Location

DKIM records are published at: selector._domainkey.domain.com

; For selector "selector1" and domain "example.com"
selector1._domainkey.example.com.    3600    IN    TXT    "v=DKIM1; k=rsa; p=..."

DKIM Record Tags

Tag	Required	Description
v	Yes	Version (always DKIM1)
k	No	Key type (default: rsa)
p	Yes	Public key (base64 encoded)
t	No	Flags (y=testing, s=strict)
h	No	Acceptable hash algorithms
s	No	Service type (default: * = all)
n	No	Notes (human-readable)

Example Records

Standard DKIM record:

selector1._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Testing mode:

selector1._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; t=y; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Key revoked (empty p=):

selector1._domainkey.example.com.    TXT    "v=DKIM1; p="

Setting Up DKIM

Microsoft 365

Microsoft 365 uses CNAME records instead of TXT records for easier management:

Step 1: Enable DKIM in Microsoft 365 Admin Center

Step 2: Add these CNAME records:

selector1._domainkey.example.com.    CNAME    selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey.example.com.    CNAME    selector2-example-com._domainkey.example.onmicrosoft.com.

Note: Replace “example-com” with your domain (hyphens replace dots).

Google Workspace

Step 1: Generate DKIM key in Google Admin Console

Step 2: Add the TXT record:

google._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Step 3: Activate DKIM signing in Google Admin

SendGrid

s1._domainkey.example.com.    CNAME    s1.domainkey.u1234567.wl001.sendgrid.net.
s2._domainkey.example.com.    CNAME    s2.domainkey.u1234567.wl001.sendgrid.net.

Mailchimp

k1._domainkey.example.com.    CNAME    dkim.mcsv.net.

Custom Mail Server

Step 1: Generate key pair

# Generate private key
openssl genrsa -out dkim-private.pem 2048

# Extract public key
openssl rsa -in dkim-private.pem -pubout -out dkim-public.pem

Step 2: Configure mail server with private key

Step 3: Publish public key in DNS:

mail._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Understanding DKIM Selectors

What Are Selectors?

Selectors allow multiple DKIM keys for the same domain:

• Different selectors for different mail systems
• Key rotation without breaking existing email
• Multiple services can each have their own key

Selector Examples

; Microsoft 365
selector1._domainkey.example.com.    CNAME    ...
selector2._domainkey.example.com.    CNAME    ...

; Google Workspace
google._domainkey.example.com.       TXT    ...

; SendGrid
s1._domainkey.example.com.           CNAME    ...
s2._domainkey.example.com.           CNAME    ...

; Custom server with date-based selector
202401._domainkey.example.com.       TXT    ...

Why Multiple Selectors?

1. Multiple email services — Each service uses its own selector
2. Key rotation — New key with new selector, old key remains valid during transition
3. Security — If a key is compromised, only that selector needs to be revoked

Best Practices for MSPs

1. Always Enable DKIM

DKIM should be enabled for every domain that sends email:

• Microsoft 365 domains
• Google Workspace domains
• Marketing platforms
• Transactional email services

2. Use 2048-bit Keys (Self-Managed Only)

If you’re managing your own DKIM keys (not using Microsoft 365, Google Workspace, or similar managed services), use at least 2048-bit RSA keys:

; 2048-bit key (recommended)
selector._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

; 1024-bit key (legacy, less secure)
; Shorter public key string

Note: Services like Microsoft 365 and Google Workspace manage key sizes automatically.

3. Plan for Key Rotation (Self-Managed Only)

If you’re managing your own DKIM keys, rotate them periodically (annually is common):

1. Create new key with new selector
2. Publish new DKIM record
3. Update mail server to sign with new key
4. Keep old record for a few days (cached signatures)
5. Remove old record

Note: Microsoft 365, Google Workspace, and other managed email services handle key rotation automatically.

4. Monitor DKIM with DMARC Reports

DMARC aggregate reports show DKIM pass/fail rates:

• Identify services not signing with DKIM
• Detect key issues before they cause problems
• Verify new DKIM setups are working

5. Document All DKIM Records

Track for each client domain:

• All DKIM selectors in use
• Which service uses which selector
• Key creation date
• Next rotation date

6. Use Unified DNS for DKIM Visibility

Managing DKIM across dozens of clients is complex. Unified DNS provides:

• View all DKIM records across all clients
• Monitor for missing or invalid DKIM
• Track key rotation schedules
• Sync documentation to Hudu

Troubleshooting DKIM

DKIM Verification Failing

Check if record exists:

dig TXT selector1._domainkey.example.com

Common causes:

• Wrong selector name
• DNS propagation not complete
• Record too long (needs splitting)
• Typo in public key

Finding the Correct Selector

From email headers: Look for s= in the DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ...

Record Length Issues

DKIM public keys are long. TXT records over 255 characters must be split:

; Automatically handled by most DNS providers
selector._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjAN" "BgkqhkiG9w0BAQEFAAOCAQ8A" "MIIBCgKCAQEA..."

Testing DKIM

Send test email to Gmail:

1. Send email to a Gmail account
2. Open email and click three dots → “Show original”
3. Look for “DKIM: PASS”

Use command line:

# Query DKIM record
dig TXT selector1._domainkey.example.com +short

Online tools:

• mail-tester.com
• mxtoolbox.com/dkim.aspx
• dkimvalidator.com

Frequently Asked Questions

What’s the difference between SPF and DKIM?

• SPF — Verifies the sending server is authorized (IP-based)
• DKIM — Verifies the email content hasn’t been modified (signature-based)

Both are needed for complete email authentication.

Can I have multiple DKIM records?

Yes! Each selector creates a separate DKIM record. This is normal when using multiple email services or rotating keys.

What happens if DKIM fails?

Depending on your DMARC policy:

• p=none — Email accepted, failure logged
• p=quarantine — Email sent to spam folder
• p=reject — Email rejected

Without DMARC, receiving servers decide independently (usually accept with lower trust).

How often should I rotate DKIM keys?

Best practice is annual rotation. Some organizations rotate more frequently (quarterly) for higher security requirements.

Do I need DKIM if I have SPF?

Yes. SPF and DKIM serve different purposes:

• SPF doesn’t survive email forwarding well
• DKIM provides message integrity
• DMARC requires at least one of them (ideally both)

What key size should I use?

Use 2048-bit RSA keys. 1024-bit keys are considered weak and may be rejected by some receivers. Some providers are moving to 4096-bit.

---

Get Started with Unified DNS

DKIM is essential for email security and deliverability. Unified DNS lets you view, modify, audit, and backup DKIM records across all your clients — with a compliance dashboard showing DKIM status for every domain and automated Hudu documentation syncing.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.