Chykalophia Docs

What a DKIM record does, how it signs your outgoing email to prove it's genuine, and why it matters for email deliverability.

Spam filters are increasingly sophisticated, and one of the things they check is whether an email has been cryptographically signed to prove it's genuine. DKIM provides that signature. This guide explains what DKIM is and why it matters for your business email.

Quick summary

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to emails sent from your domain. Receiving servers use a public key stored in your DNS to verify the signature. If it matches, the email is trusted. DKIM helps prevent spoofing and keeps your emails out of spam folders.

What DKIM stands for

DKIM stands for DomainKeys Identified Mail. It's an email authentication standard that lets senders attach a digital signature to their outgoing messages.

How DKIM works

DKIM uses a pair of cryptographic keys:

A private key stored on your email provider's sending server
A public key published in your DNS as a TXT record

When your email provider sends an email on your behalf, it creates a unique digital signature using the private key and attaches it to the email headers. When the email arrives at the recipient's server, that server looks up the public key in your DNS and uses it to verify the signature.

If the signature is valid, the email is confirmed as genuine. If the signature is missing or doesn't match, the email may be treated with suspicion.

You send an email via your email provider (e.g., Google Workspace).

Your provider signs the email with the private DKIM key stored on their servers.

The signed email is delivered to the recipient's server.

The recipient's server looks up your domain's DKIM public key in DNS.

The signature is verified. If it matches, the email passes DKIM authentication.

What a DKIM record looks like

A DKIM record is usually a TXT record in DNS, but not always: some services have you publish CNAME records that point at keys they host instead. Microsoft 365 uses two CNAMEs, and so does Mailchimp. More on Microsoft's below.

Either way, the record name has a specific format that includes a selector — a prefix that identifies which key to use, which matters if you have multiple email services.

The DNS record name looks like:

[selector]._domainkey.yourbusiness.com

For example, Google Workspace's default selector is google, and Google recommends leaving it as that:

google._domainkey.yourbusiness.com

The value of the record contains the public key — a long string of characters that looks like:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBA...

You don't need to understand the key itself — your email provider generates it and tells you exactly what to add in DNS.

How to add a DKIM record

Your email provider's setup guide will walk you through this. Generally:

Log in to your email provider's admin console (e.g., Google Admin at admin.google.com).

Find the DKIM setting. In Google Workspace it's under Menu, then Apps, then Google Workspace, then Gmail, then Authenticate email.

Generate your DKIM key within the provider's admin panel. They'll show you the DNS record to add.

Add the record to your domain's DNS at your registrar or Cloudflare — a TXT record for most providers, or two CNAME records for services that host the keys themselves, such as Microsoft 365 and Mailchimp.

Turn DKIM on back in the admin console (most providers want you to enable it once the DNS record is in place).

We handle this as part of setting up or migrating email hosting.

Multiple DKIM records

Unlike SPF, you can have multiple DKIM records — one per email service. Each uses a different selector, so they don't conflict. If you use both Google Workspace and a newsletter tool like Mailchimp, you'd have separate DKIM records for each.

Common questions

What is a DKIM selector?

A selector is a label that distinguishes one DKIM key from another, and it forms part of the DNS record name. Your email provider sets it. Google Workspace defaults to google, and recommends leaving it that way — you only change it if your domain already uses a DKIM key with the google prefix. Microsoft 365 always uses two, selector1 and selector2, and those names are the same for every Microsoft 365 organization.

What happens if DKIM is not set up?

Emails can still be delivered, but they're more likely to end up in spam — and some providers now set a floor. Google's rule for anyone sending to personal Gmail addresses is that you must have SPF or DKIM set up, and senders of more than 5,000 messages a day must have SPF, DKIM and DMARC. Having all three is the safe position either way.

Do I need to rotate DKIM keys?

For most small businesses, you don't need to actively rotate DKIM keys. Larger organizations or those with strict security policies may rotate keys periodically. Your email provider may handle this for you.

SPF checks the sending server. What does DKIM add?

SPF checks that the email came from an authorized server. DKIM checks that the email content hasn't been tampered with in transit. Together, they verify both the sender and the message integrity. DMARC then sets a policy based on both checks.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

DKIM records, explained