The basics
What a DKIM record does
DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. Your mail service signs with a private key, and you publish the matching public key in DNS so receiving servers can check the message really came from your domain and wasn't changed on the way.
Public keys live at selector._domainkey.yourdomain, where the selector is a name your mail service picks. Because selectors vary, a checker has to know or guess them. Ours looks under the names common services use; if you use a custom selector, you'll find it as s= in the DKIM-Signature header of an email you sent.
Example record · TXT at google._domainkey.example.com
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…
The p= value is the public key, shortened here. Google Workspace uses the selector google; Microsoft 365 uses selector1 and selector2.
Reading the result
What each part of the record means
| You see | It means |
|---|---|
| v=DKIM1 | Marks the record as a DKIM key. |
| k=rsa | The key type. RSA is the most common; ed25519 is newer. |
| p= | The public key itself. An empty p= means the key has been revoked. |
| Key length | 2048-bit RSA keys are the current recommendation. 1024-bit keys still work but are weak. |
| Selector | The name in front of ._domainkey, so one domain can have several keys at once. |
Common problems
DKIM mistakes we see most
DKIM never switched on
Many providers, including Microsoft 365 for custom domains, need DKIM turned on in the admin console before they sign with your domain.
Short keys
1024-bit keys are weak by today's standards. Rotate to 2048-bit where your provider allows it.
Sending services not signing
Newsletter, CRM and invoicing tools often sign with their own domain. That passes DKIM but doesn't align with yours for DMARC. Set up custom DKIM in each tool.
Broken or split key
Long keys are sometimes pasted with spaces, quotes or line breaks in the wrong places, which makes the record unreadable. Copy it exactly as your provider gives it.
Fixing it
How to fix your DKIM record
- In your mail provider's admin console, turn on DKIM signing for your domain and copy the DNS record it gives you.
- Publish it exactly as shown (a TXT record, or a CNAME for Microsoft 365) at the selector name the provider uses.
- Repeat for every service that sends as your domain, using each one's custom-domain DKIM setup.
- Send a test email, then run this check again. Once DKIM passes for all your mail, tighten DMARC.
Questions
DKIM FAQ
What is a DKIM record?
A TXT record at selector._domainkey.yourdomain holding a public key. Receiving servers use it to verify the signature your mail service adds to each message.
How do I find my DKIM selector?
Open an email you sent, view its full headers, and find the DKIM-Signature header. The value after s= is the selector and d= is the signing domain.
Is a 1024-bit DKIM key safe?
It still verifies, but 2048-bit keys are the current recommendation. Most major providers support 2048-bit keys.
Do I need DKIM if I have SPF?
Yes. DKIM survives email forwarding, which SPF does not, and DMARC passes more reliably when both are in place.
More free checks
Checking domains for clients?
Inside Scan Hub the same check runs per client and produces a white-label PDF with the evidence behind every answer. Check again after the fix and the report shows the grade before and after.