DKIM Setup Guide
Configure DKIM to add cryptographic signatures to your emails, ensuring integrity and authenticity.
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was sent by an authorized mail server and has not been modified in transit. The sending server signs emails with a private key, and receiving servers verify the signature using the public key published in DNS.
How DKIM Works
Generate Keys
Create a public/private key pair
Publish Public Key
Add TXT record to DNS
Sign Emails
Server signs with private key
Verify Signature
Receiver checks with public key
DKIM Record Format
A DKIM record is a TXT record published at selector._domainkey.yourdomain.com. The selector is a unique name that identifies this key.
| Tag | Required | Description | Example |
|---|---|---|---|
| v | Required | Version (always DKIM1) | v=DKIM1 |
| k | Optional | Key type (default: rsa) | k=rsa |
| p | Required | Public key (base64 encoded) | p=MIGfMA0GCS... |
| t | Optional | Flags (y=testing, s=strict) | t=y |
| h | Optional | Acceptable hash algorithms | h=sha256 |
| s | Optional | Service type | s=email |
| n | Optional | Notes (human readable) | n=DKIM key for marketing |
DKIM Signature Header
When an email is signed, a DKIM-Signature header is added to the message with these components:
| Tag | Description | Example |
|---|---|---|
| v | DKIM version | 1 |
| a | Algorithm (signing + hash) | rsa-sha256 |
| d | Signing domain | example.com |
| s | Selector | selector1 |
| h | Signed headers | from:to:subject:date |
| bh | Body hash | base64... |
| b | Signature | base64... |
Provider-Specific Setup
Most email providers handle DKIM key generation and signing for you. Here is how to enable DKIM for common providers:
Google Workspace
- 1Go to Admin console → Apps → Google Workspace → Gmail
- 2Click 'Authenticate email' under DKIM authentication
- 3Select your domain and click 'Generate new record'
- 4Add the TXT record to your DNS
- 5Click 'Start authentication' once DNS propagates
Microsoft 365
- 1Go to the Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies
- 2Open 'Email authentication settings' → DKIM (Microsoft renames these paths periodically — search the portal for DKIM if it has moved)
- 3Choose your domain and click 'Create DKIM keys'
- 4Add the provided CNAME records to DNS
- 5Enable DKIM signing for the domain
Amazon SES
- 1Go to SES console → Verified identities
- 2Select your domain → Authentication tab
- 3Under DKIM, click 'Edit'
- 4Choose Easy DKIM and select RSA_2048_BIT
- 5Add the 3 CNAME records provided to your DNS
Hosted DKIM with DDMARC
For senders you run yourself — your own MTA, a transactional relay, an appliance — DDMARC can generate the key pair and serve the public record from its own zone. Open your domain, go to the Hosted Services tab and use the Hosted DKIM card.
- 1Click Generate DKIM key. DDMARC creates a selector and a key pair.
- 2Copy or download the private key. It is shown once and never stored — install it on your signing server immediately. If you lose it, generate a new key rather than trying to recover it.
- 3Add the single CNAME the card shows you. DDMARC never edits your DNS.
selector._domainkey.example.com → selector.example.com.dkim.dmarc.ddmarc.comCopy the exact host and target from the card — the selector is generated for you.
Rotation is then a single click: Rotate mints a new selector and serves the new public key, and you swap one CNAME. Google Workspace and Microsoft 365 still require DKIM configured in their own admin consoles — the card tells you when it detects those senders on your domain.
Monitoring more than one selector
Most domains sign with several selectors at once — one per provider. DDMARC checks a default selector on every DNS check, and on Professional and above you can register additional selectors per domain so each one is resolved and validated on the same schedule. Add them in the domain's DNS settings; a selector that stops resolving then shows up in DNS monitoring instead of quietly breaking your DKIM alignment.
Key Rotation
DKIM keys should be rotated periodically (recommended: every 6-12 months) to maintain security. When rotating keys:
- Generate a new key pair with a different selector
- Publish the new public key in DNS before switching
- Keep the old key published for a few days after switching
- With hosted DKIM, this is the Rotate button plus one CNAME swap — DDMARC keeps serving the previous key until you retire it
Best Practices
- Use 2048-bit RSA keys — 1024-bit is deprecated and should be replaced, not treated as an acceptable floor
- Sign important headers: From, To, Subject, Date, Message-ID
- Use descriptive selector names (e.g., google2024, ses-main)
- Enable DKIM for all email services that send on your behalf
- Monitor DKIM alignment in DMARC reports
Common Issues
DKIM signature not found
Verify the mail server is configured to sign outgoing messages
DKIM signature verification failed
Check if the public key in DNS matches the signing key, and verify DNS propagation
Body hash mismatch
Email content was modified in transit. Check for mailing list software or security gateways that modify messages
Selector not found
Verify the DNS record is published at the correct location (selector._domainkey.domain.com)