DKIM Record Guide: Selectors, Keys, and Alignment
DomainKeys Identified Mail (DKIM) signs outbound messages so receivers can verify integrity. Learn how selectors, public keys, and DMARC alignment fit together.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outbound email. Your mail platform signs with a private key; the matching public key lives in DNS. Receivers verify the signature to confirm the message was authorised and not altered in transit.
SPF answers "which IP may send." DKIM answers "was this content signed by a key we publish." DMARC ties both to the From domain. Use this guide for DKIM specifics, then confirm everything with the DMARC checker.
Selectors and DNS names
Each DKIM key pair is published under a selector. If the selector is google, the public key TXT record lives at google._domainkey.yourdomain.com. Providers often give you both the selector name and the full TXT value.
google._domainkey.yourdomain.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...
- `v=DKIM1` - version tag.
- `k=rsa` - key type (RSA remains common; follow your provider).
- `p=` - the public key body; never paste the private key into DNS.
Enable DKIM in the provider first
- 1Turn on DKIM (or "authenticate email") in Google Workspace, Microsoft 365, or your ESP.
- 2Copy the generated DNS records exactly, including any CNAME-based setups some ESPs use.
- 3Wait for DNS TTL to propagate, then use the provider's "start authenticating" step.
- 4Send a test message and inspect
DKIM-Signatureand Authentication-Results headers.
Marketing tools and helpdesks often need their own DKIM keys. Missing one selector is a common reason DMARC stays stuck at p=none.
Alignment for DMARC
For DMARC to pass via DKIM, the domain in the DKIM signature (d=) must align with the From domain. Strict alignment (adkim=s) requires an exact match; relaxed allows organisational domains. Details live in DMARC policy explained.
Rotation and breakage
- Rotate keys on the schedule your provider recommends; publish the new selector before retiring the old one.
- Split long TXT values correctly if your DNS host requires 255-character chunks.
- Do not delete a selector while that ESP still signs with it.
- After DNS edits, re-run a DNS health scan and an outbound test.
DKIM is invisible when it works and loud when it does not. Finish SPF, enable DKIM for every sender, then follow DMARC setup step-by-step so policy enforcement rests on real signatures instead of hope.
