What is DKIM?

How DKIM signing works

1. Your mail server or email provider holds a private key. You publish the matching public key in DNS.
2. For each outgoing message, the server hashes the body, then signs the body hash together with a chosen list of headers (From, Subject, Date and so on).
3. It adds the result as a DKIM-Signature header saying which domain signed, which selector to look up and which headers are covered.
4. The receiver fetches the public key from DNS, recomputes the hashes and checks the signature. The result is pass, fail, neutral, temperror or permerror.

DKIM doesn’t encrypt anything and doesn’t say what to do with unsigned mail. It only proves who signed. DMARC adds the policy and the link to the From address.

Reading a DKIM-Signature header

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s1;
    t=1790000000; h=from:to:subject:date:message-id;
    bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
    b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVFOk4yAUoqOB4nujc7YopdG5...

A message can carry several DKIM signatures, for example one from your domain and one from your email provider’s domain. Each is verified on its own.

Selectors and where the public key lives

A selector is a name you choose so one domain can have many keys at once: one per sending service, plus old and new keys during rotation. The key lives at <selector>._domainkey.<domain>. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2. Other platforms pick their own.

There’s no DNS query that lists a domain’s selectors, so a receiver (or a checker) only knows a selector from a signature. To find yours, open a message you sent, view the original headers and read s= in the DKIM-Signature.

The DKIM key record: v, k, p, t

1024-bit or 2048-bit keys?

Use 2048-bit RSA keys. RFC 8301, which updated DKIM’s crypto rules, requires signers to use at least 1024 bits and recommends at least 2048, and requires verifiers to accept keys from 1024 to 4096 bits. A 2048-bit key is longer than the 255-character limit of a single TXT string, so it’s stored as two or more strings in one record. Most DNS hosts split it automatically; if yours rejects the value, add it as quoted chunks. Some older DNS hosts can’t do this, and that’s the only good reason to stay at 1024.

CNAME-delegated keys used by email providers

Many providers (Amazon SES, SendGrid, Mailchimp, HubSpot, Microsoft 365 and others) don’t give you a key to paste. They ask you to publish one or more CNAMEs that point your selector at a record they host:

Receivers follow the CNAME and read the provider’s TXT record. The benefit is that the provider can rotate keys without you touching DNS. Delete the CNAMEs when you stop using a provider, so nobody else can take over that name.

How to rotate and revoke DKIM keys

Rotate keys you manage yourself at least once a year, or right away if a private key may have leaked:

1. Generate a new key pair and publish the public key under a new selector (s2).
2. Wait for DNS to propagate, then switch signing to the new selector.
3. Keep the old selector published for a few days so mail already in transit still verifies.
4. Revoke the old key by publishing it with an empty p= (v=DKIM1; p=), or remove the record.

With DMARC Dojo, DKIM selectors are CNAMEs to records we host, so a rotated key is published without another edit at your DNS host.

To check a specific selector, use the DKIM checker.

Forwarding, mailing lists and ARC

Plain forwarding usually leaves the message untouched, so the DKIM signature still verifies at the final destination, even though SPF fails there. Mailing lists are different: many add a subject tag like [team] or a footer, which changes signed content and breaks the signature. ARC (Authenticated Received Chain, RFC 8617) lets intermediaries record the authentication results they saw before modifying a message, and some receivers use it to accept such mail.

DKIM and DMARC alignment

For DMARC, a DKIM pass only counts if the signature’s d= domain matches the From domain. In the default relaxed mode, d=mail.example.com aligns with From: you@example.com, but d=esp.example doesn’t. Many providers sign with their own domain until you set up custom DKIM for yours, which is the most common reason legitimate mail fails DMARC. See DMARC alignment and what DMARC is.