DKIM Explained: How to Set Up and Verify DKIM Signatures (2026 Guide)

If SPF is a guest list at the door, DKIM is a tamper-proof wax seal on the envelope itself. It doesn't just say who's allowed to send — it cryptographically proves the email wasn't altered in transit and genuinely came from your domain.

DKIM is the second pillar of email authentication, and it's the one most often set up incorrectly — usually because of a single broken TXT record. This guide covers exactly how DKIM works, how to configure it for major providers, and how to catch the mistakes that silently break it.

---

1. What Is DKIM?

DKIM (DomainKeys Identified Mail) adds a digital signature to the headers of every outgoing email. This signature is generated using a private key that only your mail server holds. When the email arrives, the receiving server looks up the corresponding public key, published as a DNS TXT record on your domain, and uses it to verify:

1. The email genuinely originated from a server authorized to sign for your domain.
2. The signed parts of the message (subject, body, key headers) were not modified in transit.

This is defined in RFC 6376, and unlike SPF, DKIM survives most forwarding scenarios because the signature travels with the message itself rather than relying on the sending IP.

---

2. How DKIM Works, Step by Step

1. Signing. Your outgoing mail server takes specific parts of the email (headers + body), hashes them, and encrypts that hash with your domain's private key. This encrypted hash is added as a DKIM-Signature header.
2. Publishing. The matching public key is published in your DNS as a TXT record at a special address: selector._domainkey.yourdomain.com.
3. Verification. The receiving server extracts the DKIM-Signature header, fetches your public key from DNS using the selector named in that header, and decrypts the hash.
4. Comparison. It re-hashes the received message and compares the two hashes. A match means the message is authentic and unaltered; a mismatch means it failed DKIM.

---

3. Anatomy of a DKIM DNS Record

A DKIM record is published at a selector-based hostname, not just your bare domain. This is what makes DKIM different from SPF:

Host: google._domainkey.yourdomain.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

The selector is what you'll see referenced in the DKIM-Signature header of any email — it's how the receiving server knows exactly which DNS record to fetch.

---

4. Setting Up DKIM by Provider

DKIM can't be set to arbitrary values like SPF — your provider generates the key pair, and you publish the exact public key they give you.

Google Workspace

1. In the Admin Console, go to Apps → Google Workspace → Gmail → Authenticate Email.
2. Generate a new DKIM key (2048-bit recommended).
3. Google gives you a host name (e.g. google._domainkey) and a TXT value — publish both exactly as shown.
4. Return to the Admin Console and click Start Authentication once DNS has propagated.

Microsoft 365

1. In the Microsoft 365 Defender portal, go to Email & Collaboration → Policies → DKIM.
2. Select your domain — Microsoft auto-generates two CNAME records (selector1._domainkey and selector2._domainkey) rather than a single TXT record.
3. Publish both CNAMEs exactly as provided, then toggle DKIM signing on.

Zoho Mail

1. Go to Control Panel → Email Authentication → DKIM.
2. Zoho generates a selector and public key for your domain.
3. Publish the TXT record, then click Verify.

Amazon SES

1. In the SES console, enable Easy DKIM for your verified domain.
2. AWS provides three CNAME records to publish.
3. Status flips to "verified" automatically once DNS propagates.

---

5. Common DKIM Mistakes

• Line breaks or extra quotes in the public key. Some DNS registrars split long TXT values into multiple quoted strings automatically — if pasted incorrectly, the key becomes invalid. Copy the value exactly as your provider displays it.
• Wrong selector. If your DKIM-Signature header says s=google but you published the key under a different selector name, verification will fail every time.
• Key not rotated after a provider migration. Switching email providers without updating your DKIM selector leaves the old key active or the new one missing entirely.
• Truncated public key. DKIM public keys are long. Copy-paste errors that cut off characters are one of the most common causes of "DKIM record not found" errors.
• Forgetting DKIM entirely on subdomains that send their own mail (e.g. a marketing subdomain using a separate ESP).

---

6. How to Verify Your DKIM Record

1. Send yourself a test email from the account you're configuring.
2. Open the raw message source and locate the DKIM-Signature header — note the d= (domain) and s= (selector) values.
3. Go to the DKIM Checker, enter your domain and that exact selector.
4. Confirm the tool returns a valid public key with no formatting errors.
5. For a deeper look at how the signature and routing headers relate, use the Email Header Analyzer to trace the full delivery path — check our anonymous email guide for more on how headers reveal a message's true origin.

---

7. DKIM Alone Still Isn't the Full Picture

DKIM proves authenticity and integrity — but on its own, it doesn't tell receiving servers what to do when a message fails the check, and it doesn't verify that the visible "From" address matches the signing domain. That policy layer is DMARC, which works together with both SPF and DKIM.

Read next: SPF vs DKIM vs DMARC: What's the Difference?

---

FAQ

Does every email need to be DKIM-signed? Ideally yes, for any domain sending mail you want reliably delivered. Most major providers sign automatically once DKIM is configured — no per-email action needed.

Can I use the same DKIM selector across multiple sending tools? No — each sending service (Google Workspace, your CRM, your marketing platform) typically issues its own selector and key pair. Publish each one as a separate TXT/CNAME record.

What's a good DKIM key length? 2048-bit RSA is the current standard. 1024-bit keys are considered weak and are being phased out by major mailbox providers.

Why does Gmail show "signed-by" a different domain than the sender? This usually means the email was relayed through a third-party service (like a marketing platform) that signs with its own domain rather than yours — worth checking your d= value in the DKIM-Signature header.