> ## Content Index > Fetch the complete content index at: https://droppoint.xyz/llms.txt > Use this file to discover other available public pages before exploring further. # What Is DKIM? - URL: https://droppoint.xyz/what-is-dkim/ - Published: 2026-09-20T17:54:29.000Z - Updated: 2026-09-21T04:56:47.000Z - Description: How DomainKeys Identified Mail verifies your email authenticity. - Author: Ohidur Rahman - Tags: Email Security, DNS, #Import 2026-09-24 11:21 DKIM (DomainKeys Identified Mail) is an email authentication protocol that allows the sender to digitally sign outgoing messages. The signature is attached to the email header and can be verified by the receiving mail server using a public key published in the sender’s DNS records. DKIM helps receiving servers confirm two things: that the message genuinely came from the domain it claims to be from, and that the content of the message was not altered during transit. Along with [SPF](https://droppoint.xyz/what-is-spf/) and [DMARC](https://droppoint.xyz/what-is-dmarc/), DKIM is one of the three essential email authentication protocols that every business domain should have in place. ## Why DKIM Matters for Your Business Email travels through multiple servers between sender and recipient. At any point along that path, a message could potentially be intercepted and modified. DKIM provides a way to detect this. Without DKIM: - There is no way for recipients to verify that an email claiming to be from your domain was actually sent by you - Messages can be modified in transit without detection - Your emails are more likely to be treated as suspicious by spam filters - Your domain lacks one of the key signals that major email providers use to determine inbox placement Gmail, Microsoft 365, Yahoo and other major email providers all check for DKIM signatures when deciding whether to deliver a message to the inbox or the spam folder. A valid DKIM signature is a strong positive signal. ## How DKIM Works DKIM uses public key cryptography to sign and verify messages. Here is the process: ### Sending Side 1. Your email hosting provider generates a pair of cryptographic keys — a private key and a public key 2. The private key is stored securely on your mail server 3. The public key is published as a TXT record in your domain’s DNS 4. When you send an email, your mail server uses the private key to create a digital signature based on the message content (headers, body, or both) 5. This signature is added to the email as a DKIM-Signature header ### Receiving Side 1. The receiving mail server sees the DKIM-Signature header in the incoming message 2. It extracts the domain name and selector from the signature to look up the public key in DNS 3. It uses the public key to verify the signature against the message content 4. If the signature is valid, the DKIM check passes — confirming the message is authentic and unaltered This entire process happens automatically and is invisible to both the sender and the recipient. ## What a DKIM Signature Looks Like When an email is signed with DKIM, a header like this is added to the message: ``` DKIM-Signature: v=1; a=rsa-sha256; d=yourcompany.com; s=selector1; c=relaxed/relaxed; h=from:to:subject:date:message-id; bh=abc123...; b=xyz789... ``` The key parts are: - v=1 — the DKIM version - a=rsa-sha256 — the signing algorithm used - d=yourcompany.com — the domain that signed the message - s=selector1 — the selector, which identifies which public key to use (a domain can have multiple DKIM keys) - h= — the list of headers included in the signature - bh= — the hash of the message body - b= — the actual digital signature You do not need to create this header manually. Your email hosting provider’s mail server generates it automatically for every outgoing message. ## What a DKIM DNS Record Looks Like The public key is published as a TXT record in your DNS. The record name follows the format selector.\_domainkey.yourcompany.com. For example: ``` selector1._domainkey.yourcompany.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..." ``` The components are: - v=DKIM1 — identifies this as a DKIM record - k=rsa — the key type (RSA is the most common) - p= — the public key itself, encoded in base64 Your email hosting provider will give you the exact DNS record to add. You publish it in your domain’s DNS settings, typically at your domain registrar or DNS hosting provider. ## DKIM Selectors A selector is a label that identifies a specific DKIM key pair. Selectors allow a domain to have multiple DKIM keys active at the same time. This is useful in several situations: - Key rotation — you can set up a new key before retiring the old one, ensuring there is no gap in authentication - Multiple sending services — if your business email, marketing platform and CRM all send email from your domain, each can have its own DKIM key with a different selector - Provider migration — when switching email providers, the new provider can use a different selector without conflicting with the old one Common selector names include selector1, selector2, google, or s1 — but the name itself does not matter as long as it matches between the DNS record and the DKIM-Signature header. ## What DKIM Does and Does Not Do ### DKIM Does - Verify that the message was sent by the domain in the signature - Detect if the message was modified after it was signed - Provide a strong authentication signal to spam filters - Survive email forwarding better than SPF (since it is tied to the message, not the sending server) ### DKIM Does Not - Encrypt the email content — DKIM signs the message but does not hide it - Prevent someone from sending unsigned email claiming to be from your domain — that is what DMARC handles - Tell receiving servers what to do with messages that fail the check — again, that is DMARC’s role This is why DKIM works best in combination with [SPF](https://droppoint.xyz/what-is-spf/) and [DMARC](https://droppoint.xyz/what-is-dmarc/). Each protocol covers a different gap. ## DKIM and Email Forwarding One advantage DKIM has over [SPF](https://droppoint.xyz/what-is-spf/) is how it handles email forwarding. When an email is forwarded, the sending IP address changes — which often causes SPF to fail, because the forwarding server’s IP is not in the original domain’s SPF record. DKIM, on the other hand, is attached to the message itself. As long as the message content is not modified during forwarding, the DKIM signature remains valid. This makes DKIM a more reliable authentication method for messages that pass through mailing lists or forwarding services. ## Common DKIM Problems ### Missing DNS Record If the public key is not published in DNS, or the selector name does not match, receiving servers cannot verify the DKIM signature. The check will fail as if the message were unsigned. ### Key Mismatch If the private key on the mail server and the public key in DNS do not match — for example, after a key rotation that was not completed properly — all DKIM checks will fail. ### Message Modification Some email systems modify messages in transit — for example, adding a footer, rewriting URLs, or changing formatting. If the modified parts were included in the DKIM signature, the signature will break and the check will fail. ### DNS Propagation Like all DNS records, DKIM records take time to propagate. If you have just added or changed a DKIM record, it may take up to 48 hours for all DNS servers to have the updated record. Check your [MX record](https://droppoint.xyz/what-is-mx-record/) TTL settings to understand propagation timing. ## How to Check Your DKIM Record To verify your DKIM setup, you need to know your selector name. Your email hosting provider can tell you this, or you can find it by looking at the headers of an email you have sent. ### Online Tools MXToolbox DKIM Lookup, dmarcian, and Google Admin Toolbox let you enter your domain and selector to check whether the public key is published and valid. ### Command Line You can query the DKIM record directly: ``` dig selector1._domainkey.yourcompany.com TXT ``` Replace selector1 with your actual selector name. The response should contain your public key. ### Email Headers Send a test email to a Gmail or Outlook account and view the full message headers. Look for the DKIM-Signature header and check whether the results show dkim=pass. ## Setting Up DKIM DKIM setup typically involves: 1. Your email hosting provider generates the DKIM key pair and gives you the public key as a DNS record 2. You add the TXT record to your domain’s DNS settings using the selector name provided 3. You wait for DNS propagation (usually a few minutes to a few hours) 4. You send a test email and check the headers to confirm dkim=pass 5. You monitor DMARC reports to ensure DKIM is passing consistently Most [business email hosting](https://droppoint.xyz/business-email-hosting/) providers handle the key generation and server configuration for you. Your main task is adding the DNS record. ## Summary DKIM is an essential email authentication protocol that digitally signs your outgoing messages, allowing recipients to verify that the email is genuine and has not been tampered with. It is a key factor in email deliverability and protects your domain’s reputation. Together with SPF and DMARC, DKIM forms a complete email authentication system. Every business that sends email from its own domain should have DKIM configured. Need help setting up DKIM for your domain? [Contact our team](https://droppoint.xyz/contact/) and we’ll configure it as part of your [email security](https://droppoint.xyz/email-security/) setup.