Chuhching

← All articles

DKIM — DomainKeys Identified Mail

DKIM cryptographically signs every outbound message using a private key your SMTP provider holds. Receiving mail systems read the matching public key from a TXT record at <selector>._domainkey.yourdomain.com and verify the signature. This gives receivers hard proof the message was sent by an authorized provider and wasn't tampered with in transit.

Unlike SPF and DMARC — the record is per-provider

We can't auto-verify DKIM in the Domain Health check because the TXT record lives at a selector that only your provider knows. Paste the exact record they generate for you.

Per-provider setup

Google Workspace

  1. Admin Console → Apps → Google Workspace → Gmail → Authenticate email.
  2. Select your domain, click Generate new record (2048-bit).
  3. Copy the generated host (google._domainkey) and value, add it as a TXT record in your DNS.
  4. Wait 5–15 minutes, return to the Admin Console and click Start authentication.

Docs: Google's DKIM walkthrough.

Microsoft 365

Microsoft uses two selectors: selector1._domainkey and selector2._domainkey. Both are CNAMEs pointing to Microsoft's hosted keys. Enable via:

  1. Microsoft 365 Defender portal → Email & collaboration → Policies → Email authentication settings → DKIM.
  2. Select your domain, flip the toggle to Enabled.
  3. Microsoft will give you two CNAME targets; add them verbatim in DNS (host selector1._domainkey and selector2._domainkey).

Resend

  1. Dashboard → Domains → Add domain.
  2. Resend generates 3 TXT records (one SPF, one DKIM at resend._domainkey, one MX for the bounce subdomain). Add all three.
  3. Click Verify DNS records.

Mailgun

  1. Dashboard → Sending → Domain Settings → DNS records.
  2. Add the TXT record at mx._domainkey (older) or k1._domainkey (newer).

SendGrid

  1. Settings → Sender Authentication → Authenticate Your Domain.
  2. SendGrid creates 3 CNAMEs at s1._domainkey, s2._domainkey, and em[id] pointing to their hosted keys.

Postmark

  1. Servers → Sending Domains → Add domain.
  2. Add the TXT record at 20220101175836pm._domainkey (or whatever date-stamped selector Postmark generates).

Verify

Use mxtoolbox.com/dkim and plug in your domain + selector. From a terminal: dig txt google._domainkey.yourdomain.com.

Rotating keys

Providers sometimes rotate DKIM keys. Google, for instance, prompts you to rotate annually. When that happens, add the new record first, wait for propagation, then swap your provider setting — don't remove the old record until the new one has replaced it at every receiver.

Next

Finish with DMARC, or read the end-to-end guide at Sending domain setup.