Home / Learn / What is DKIM?

What is DKIM?

DKIM adds a cryptographic signature to each email, so the receiver can check that the message came from your domain and wasn't altered.

Updated 2026-10-18

TL;DR

  • DKIM signs outgoing mail with a private key. The receiver checks the signature against a public key published in DNS.
  • The DNS record sits at selector._domainkey.yourdomain.com. The selector lets one domain use several keys.
  • Google asks for a DKIM key of 1024 bits or longer for personal Gmail and recommends 2048 where your provider supports it.

The short definition

DKIM (DomainKeys Identified Mail) puts a digital signature in a message header. Your mail server signs selected headers and the body with a private key. The receiving server fetches the matching public key from your DNS and checks the signature. If it matches, the message really passed through a system that holds your key and it wasn't changed on the way.

What it looks like

The signature travels in the message:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail2026;
  h=from:to:subject:date; bh=...; b=...

Here d= is the signing domain and s= the selector. The receiver looks up this record:

mail2026._domainkey.example.com.  IN TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUA..."

The p= value is the public key. Because the selector is part of the name, you can rotate keys by publishing a new selector and switching, and run separate keys for separate senders.

Key length

Google's sender guidelines say that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommend 2048-bit keys where your provider supports them (Google email sender guidelines, checked 2026-10-18). Long keys sometimes need splitting over two strings in a DNS editor.

Why DKIM matters for senders

  • It is required. The same Google page says all senders must set up SPF or DKIM, and bulk senders need both plus DMARC.
  • It survives forwarding better than SPF, because the signature is in the message rather than tied to the server that delivered it.
  • It feeds DMARC. DMARC passes when SPF or DKIM passes and the domain aligns with the From address.
  • Your sending platform may sign for you. With cold-email tools you normally publish the keys they give you; ask your platform for the exact record.

DKIM and email verification

DKIM tells receivers about the sender. It says nothing about whether the recipient's mailbox exists, which is what our SMTP check answers (how it works). A signed message to a dead address still bounces. See hard vs soft bounces.

Authentication is not verification. SPF, DKIM and DMARC describe how a domain sends mail. They do not say whether a mailbox exists. Mail Exchange checks the second thing (syntax, MX, risk lists, SMTP mailbox check and a catch-all test), so use both: authenticate your sending domain and verify your list.

To confirm your DKIM record exists, use the free email authentication checker. Note that you need to know the selector to find a DKIM record, since it isn't discoverable from the domain alone.

Sources

Common questions

What is DKIM in simple terms?

A signature added to each outgoing email. The receiver checks it against a public key in your DNS to confirm the message came from your domain and wasn't changed.

What is a DKIM selector?

A label in the DNS name (selector._domainkey.yourdomain.com) that tells the receiver which public key to fetch. It lets a domain use several keys.

Do I need both SPF and DKIM?

Google says all senders need SPF or DKIM, and bulk senders over 5,000 messages a day to Gmail need both plus DMARC. Set up both anyway.

Related

Start your free trial →