What is DKIM?

How DKIM works

1. Your mail server signs each outgoing message with a private key and adds a DKIM-Signature header.
2. That header names your domain (d=) and a selector (s=).
3. The receiver looks up the public key at selector._domainkey.yourdomain and verifies the signature.

If the signature checks out, the receiver knows the signed parts of the message weren't changed in transit and that the signing domain authorised it.

What a DKIM record looks like

selector1._domainkey.example.co.za.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Some providers publish DKIM as a CNAME instead, pointing to a key they host and rotate for you — Microsoft 365 does this, for example.

Selectors

A selector is just a label that lets one domain have several keys at once — one per sending service, or old and new keys during rotation. Common selectors include google, selector1/selector2 (Microsoft 365), default (many cPanel servers) and k1 (Mailchimp). Your provider tells you which to use.

Key length and rotation

• Use 2048-bit RSA keys where your DNS host supports long TXT records. 1024-bit keys are still accepted but are considered weak.
• Rotate keys periodically: publish a new selector, switch signing to it, then remove the old record after a few days.

DKIM and DMARC alignment

For DMARC to pass via DKIM, the signing domain (d=) must match your From domain (or share the same organisational domain under relaxed alignment). A newsletter platform signing with its own domain passes DKIM but not DMARC alignment — set up custom DKIM for your domain in the platform.

Check DKIM

Run the Email Deliverability Checker, or look up a known selector directly with the TXT lookup (enter selector._domainkey.yourdomain).