What is DKIM?

DomainKeys Identified Mail (DKIM) is an email authentication protocol that allows the sending mail server to cryptographically sign outgoing messages. The signature is placed in a special email header, and the corresponding public key is published in a DNS TXT record under a selector-specific subdomain.

When a receiving server gets an email claiming to be from your domain, it looks up the DKIM public key in DNS using the selector specified in the email header, then uses that key to verify the digital signature. If the signature matches, the receiver knows the message was not tampered with and was sent by an authorized server.

Understanding DKIM Selectors

A DKIM selector is a string used to locate the DKIM public key in DNS. The full DNS lookup is: selector._domainkey.yourdomain.com. Different email services use different selectors, which allows a domain to have multiple DKIM keys for different sending services simultaneously.

Common selectors include default (generic), google (Google Workspace), selector1 and selector2 (Microsoft 365), k1 (Mailchimp), and pm (Postmark). Your email provider will tell you which selector to use when setting up DKIM.

Why DKIM Matters for Deliverability

DKIM is one of the three pillars of email authentication, alongside SPF and DMARC. Without a valid DKIM signature, your emails are more likely to be flagged as spam or rejected entirely. Major inbox providers like Gmail and Outlook heavily weight DKIM status when making filtering decisions.

A properly configured DKIM record builds your domain reputation over time, increasing the chances that your messages reach the inbox. It also protects your brand from email spoofing and phishing attacks that could damage your sender reputation.

How to Fix DKIM Issues

• No record found: Verify the selector is correct and the DNS TXT record is published at the right subdomain. DNS propagation can take up to 48 hours.
• Testing mode (t=y): Remove the t=y flag once you have confirmed DKIM signing is working correctly in production.
• Weak key length: Use at least a 1024-bit key. 2048-bit RSA keys are recommended for stronger security.
• CNAME delegation: Some providers use a CNAME record pointing to their DKIM key. Ensure the CNAME resolves correctly to a valid TXT record.