What is DKIM and how does it work?

DKIM (DomainKeys Identified Mail) adds a tamper-evident cryptographic signature to your outgoing email. Receivers use a public key in your DNS to confirm the message really came from your domain and wasn't altered in transit. It's the second pillar of email authentication.

What DKIM actually does

When your mail server sends a message, it creates a signature over the headers and body using a private key only you hold, and attaches it as a DKIM-Signature header. The matching public key lives in your DNS. Any receiver can fetch the public key and verify the signature — proving the message is genuinely from your domain and hasn't been tampered with.

Selectors: where the key lives

DKIM public keys are published at a selector:

# Windows
nslookup -type=txt selector._domainkey.yourdomain.com

# Mac / Linux
dig txt selector._domainkey.yourdomain.com +short

Your provider picks the selector name (for example google, s1, k1). Because each sending service uses its own selector, every service that sends as you needs its own DKIM key set up — a tool you forgot to configure simply won't be signing.

Alignment: why DKIM matters for DMARC

DMARC passes when SPF or DKIM passes and the signing domain aligns with the visible From domain. DKIM has a big advantage over SPF here: a DKIM signature survives forwarding, where SPF usually breaks. That's why DKIM is essential for getting forwarded mail and mailing lists through enforcement.

Keys and rotation

  • Use a 2048-bit key; treat 1024-bit as legacy.
  • Rotate keys periodically and whenever a key may be exposed.
  • Keep old selectors live briefly during rotation so in-flight mail still verifies.

Common DKIM problems

  • A sender not signing — the most common gap; that service's mail fails DMARC alignment.
  • The key not published (or truncated in DNS) so verification fails.
  • Body modifications by a mailing list breaking the signature — handled with proper configuration.

Frequently asked questions

Where is the DKIM record stored?

In DNS, as a TXT record at a selector subdomain: selector._domainkey.yourdomain.com. The selector is chosen by your sending provider, so each provider you use publishes its own DKIM key under its own selector.

How long should a DKIM key be?

Use at least a 2048-bit RSA key. Older 1024-bit keys are still common but are considered weak; most providers now default to 2048-bit. Keys should also be rotated periodically.

Does DKIM stop spoofing on its own?

No. DKIM proves a message was signed by your domain, but on its own it doesn't tell receivers to reject unsigned or forged mail — that's DMARC's job. DKIM and DMARC work together: DKIM provides the verifiable identity, DMARC enforces it.

Confirm every sender is signing with DKIM

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

Related guides: Can someone send email as your domain? How to check. · DMARC p=none vs p=reject: which policy actually protects you?

← All guides