DKIM records, explained

Spam filters are increasingly sophisticated, and one of the things they check is whether an email has been cryptographically signed to prove it's genuine. DKIM provides that signature. This guide explains what DKIM is and why it matters for your business email.

What DKIM stands for

DKIM stands for DomainKeys Identified Mail. It's an email authentication standard that lets senders attach a digital signature to their outgoing messages.

How DKIM works

DKIM uses a pair of cryptographic keys:

A private key stored on your email provider's sending server
A public key published in your DNS as a TXT record

When your email provider sends an email on your behalf, it creates a unique digital signature using the private key and attaches it to the email headers. When the email arrives at the recipient's server, that server looks up the public key in your DNS and uses it to verify the signature.

If the signature is valid, the email is confirmed as genuine. If the signature is missing or doesn't match, the email may be treated with suspicion.

You send an email via your email provider (e.g., Google Workspace).

Your provider signs the email with the private DKIM key stored on their servers.

The signed email is delivered to the recipient's server.

The recipient's server looks up your domain's DKIM public key in DNS.

The signature is verified. If it matches, the email passes DKIM authentication.

What a DKIM record looks like

A DKIM record is usually a TXT record in DNS, but not always: some services have you publish CNAME records that point at keys they host instead. Microsoft 365 uses two CNAMEs, and so does Mailchimp. More on Microsoft's below.

Either way, the record name has a specific format that includes a selector: a prefix that identifies which key to use, which matters if you have multiple email services.

The DNS record name looks like:

[selector]._domainkey.yourbusiness.com

For example, Google Workspace's default selector is google, and Google recommends leaving it as that:

google._domainkey.yourbusiness.com

The value of the record contains the public key: a long string of characters that looks like:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBA...

You don't need to understand the key itself. Your email provider generates it and tells you exactly what to add in DNS.

How to add a DKIM record

Your email provider's setup guide will walk you through this. Generally:

Log in to your email provider's admin console (e.g., Google Admin at admin.google.com).

Find the DKIM setting. In Google Workspace it's under Menu, then Apps, then Google Workspace, then Gmail, then Authenticate email.

Generate your DKIM key within the provider's admin panel. They'll show you the DNS record to add.

Add the record to your domain's DNS at your registrar or Cloudflare: a TXT record for most providers, or two CNAME records for services that host the keys themselves, such as Microsoft 365 and Mailchimp.

Turn DKIM on back in the admin console (most providers want you to enable it once the DNS record is in place).

We handle this as part of setting up or migrating email hosting.

Multiple DKIM records

Unlike SPF, you can have multiple DKIM records: one per email service. Each uses a different selector, so they don't conflict. If you use both Google Workspace and a newsletter tool like Mailchimp, you'd have separate DKIM records for each.

Common questions

What is a DKIM selector?

A selector is a label that distinguishes one DKIM key from another, and it forms part of the DNS record name. Your email provider sets it. Google Workspace defaults to google, and recommends leaving it that way. You only change it if your domain already uses a DKIM key with the google prefix. Microsoft 365 always uses two, selector1 and selector2, and those names are the same for every Microsoft 365 organization.

What happens if DKIM is not set up?

Emails can still be delivered, but they're more likely to end up in spam, and some providers now set a floor. Google's rule for anyone sending to personal Gmail addresses is that you must have SPF or DKIM set up, and senders of more than 5,000 messages a day must have SPF, DKIM and DMARC. Having all three is the safe position either way.

Do I need to rotate DKIM keys?

For most small businesses, you don't need to actively rotate DKIM keys. Larger organizations or those with strict security policies may rotate keys periodically. Your email provider may handle this for you.

SPF checks the sending server. What does DKIM add?

SPF checks that the email came from an authorized server. DKIM checks that the email content hasn't been tampered with in transit. Together, they verify both the sender and the message integrity. DMARC then sets a policy based on both checks.

SPF and DKIM are two separate checks on the same email: one on the sending server, one on the signature. DMARC is not a third check: it is the policy that tells receiving servers what to do with emails that fail SPF or DKIM.

Read this as text

An email arrives claiming to be from your domain. The receiving mail server runs two checks on it. SPF checks the envelope: is this mail server on the approved list? DKIM checks the letter: was this email signed by the claimed domain, and is the signature still intact?

If both checks pass, the email has been authenticated and there is nothing for your DMARC policy to act on. Authentication on its own is not a promise of the inbox: spam filters also weigh things like your message content.

If either check fails, your DMARC policy tells the receiving server what to do. A policy of none delivers the email anyway and sends reports to you as the domain owner. Quarantine puts it in the spam or junk folder. Reject blocks it entirely, so it never reaches the recipient.