Home/ Glossary/ DomainKeys Identified Mail

DomainKeys Identified Mail (DKIM)

Security Glossary - Email Authentication

Definition: DKIM is an email authentication method that adds a digital signature to outgoing emails. The sending server signs the message with a private key, and the signature is verified by the receiving server using the corresponding public key published in the sender's DNS. This proves the message was authorized by the domain owner and was not modified in transit.

Why You Should Care About DKIM

DKIM provides two critical assurances: that the email was authorized by the domain owner (authentication) and that the message body and key headers were not altered during delivery (integrity). Unlike SPF, which only checks the sending server's IP, DKIM verifies the message itself.

DKIM signatures survive email forwarding, which is a significant advantage over SPF. When an email is forwarded, the SPF check often fails because the forwarding server's IP is not in the original domain's SPF record. The DKIM signature, however, remains valid because the message content has not changed.

Setting up DKIM requires generating a key pair, publishing the public key in DNS as a TXT record, and configuring your email server to sign outgoing messages. Most email providers (Google Workspace, Microsoft 365, SendGrid) handle key management and signing automatically once you add the DNS records they provide.

Settings Overview

DKIM ComponentDescription
Private keyHeld by sending mail server, signs message headers
Public keyPublished as DNS TXT record at selector._domainkey.domain
SelectorIdentifier for the key pair (e.g., google, s1, default)
d= tagSigning domain
s= tagSelector name
b= tagCryptographic signature

How to Verify

A DNS health checker verifies that your DKIM records are published correctly in DNS. Send a test email and check the Authentication-Results header to confirm DKIM signatures are passing. Each email service you use needs its own DKIM configuration.

See how your site handles DKIM

Check DNS Health

Questions and Answers

How do I set up DKIM?
Your email provider gives you a DNS record to publish (usually a TXT or CNAME record at selector._domainkey.yourdomain.com). Add this record to your DNS, and the provider handles signing outgoing messages automatically. Each provider uses a different selector name.
Can I have multiple DKIM keys?
Yes. Each email service you use (transactional email, marketing email, corporate email) should have its own DKIM selector and key pair. Multiple DKIM records with different selectors coexist without conflict.

Learn More

Sender Policy Framework Domain-based Message Authentication, Reporting and Conformance DKIM Selector DKIM Alignment Email Deliverability
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.