What is DKIM?

DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing email. The sending server signs chosen headers and the body with a private key. Receivers fetch the matching public key from a DNS TXT record and check that the message was not altered and that the signing domain authorised it. DKIM is defined in RFC 6376.

Why it matters

DKIM proves that a message was signed by a domain that holds the private key and that the signed parts were not changed on the way. Unlike SPF, the signature travels inside the message, so it usually survives forwarding. DMARC accepts a pass from either SPF or DKIM, provided the signing domain lines up with the From address, so a working DKIM setup is the most reliable route to DMARC passing.

How to check

Find your selector. The signature header in a sent message looks like this, where d= is the signing domain and s= is the selector:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; h=from:to:subject:date; bh=...; b=...

Look up the public key. It is a TXT record at selector._domainkey.domain:

dig TXT selector1._domainkey.example.com +short

The answer should look like "v=DKIM1; k=rsa; p=MIIBIjANBg...". The p= value is the public key. An empty p= means the key has been revoked.
Send a test message to a mailbox you control and open the original message source. Look in the Authentication-Results header for dkim=pass and confirm that the header.d domain is your own.
If you are setting DKIM up for the first time, follow the DKIM setup guide. Your email provider creates the key pair and shows you the DNS record to publish.

Crawvix's scan checks "DKIM signing key is published" for your domain.

Common mistakes

Publishing the record under the wrong selector name, so receivers find nothing.
Letting a DNS provider cut or break a long key. A 2048-bit key is longer than 255 characters and is normally split into several quoted strings within one record.
Sending through a service that signs with its own domain only. The signature passes, but it does not line up with your From address, so it does not help DMARC. See DMARC alignment explained.
Using a key that is too short. Providers commonly recommend 2048-bit RSA keys.
Never rotating keys, or deleting the old record before mail signed with it has been delivered.

Frequently asked questions

Does DKIM encrypt my email?

No. It signs the message to show it is genuine and unaltered, but the content is not hidden. Encryption in transit is a separate job, handled by TLS.

Can I have more than one DKIM key?

Yes. Each key has its own selector, so different services or a rotated key can coexist on the same domain.

Is DKIM enough without SPF?

DMARC needs only one of the two to pass and align, so DKIM alone can be enough for DMARC. Publishing both gives receivers more to work with and covers different failure cases, such as forwarding.

Want to see whether your domain publishes a signing key? Try the free website sample.