DomainKeys Identified Mail, or DKIM, is an email authentication standard that helps receiving mail servers confirm that outgoing emails were authorized by the domain owner and were not altered in transit. DKIM works by adding a cryptographic DKIM-Signature header to each message. The receiving email server uses a DNS lookup to find the matching DKIM record, retrieve the public key, and verify signature integrity.
A DKIM record is published as a DNS TXT record under a specific selector and domain name. This DNS TXT record contains the public key value, usually in the p tag, along with other DKIM tag values such as the key type and K tag. When configured correctly, DKIM authentication supports trusted email delivery and reduces the likelihood that legitimate mail will be treated as spoofed or suspicious.
DKIM is most effective when combined with SPF and DMARC. SPF verifies whether an email sending source is allowed to send for a domain, while DMARC tells receiving systems how to handle messages that fail SPF or DKIM authentication. Together, SPF, DKIM, and DMARC form the foundation of modern email authentication for organizations using Google Workspace, Microsoft 365, Mailchimp, or any ESP.
For teams starting from scratch, a DKIM generator such as the EasyDMARC DKIM Record Generator can simplify the creation of the DKIM key pair and the required DNS TXT record.
How a DKIM Generator Creates Public and Private Keys
A DKIM generator creates a DKIM key pair: a private key used by the mail server to sign emails, and a public key published in DNS so recipients can verify signature authenticity. The private key must remain secure on the email server, ESP, or Hosted DKIM service. The public key is safe to expose because it is designed only to validate the DKIM-Signature, not to create one.
Most DKIM generator tools ask for a domain name, selector, key type, and key length. The selector identifies which DKIM record should be queried in DNS. For example, a selector such as “s1” or “google” creates a lookup path similar to:
selector._domainkey.example.com
The resulting DNS TXT record includes the public DKIM key and other metadata. A typical DKIM record may include v=DKIM1, k=*rsa*, and the p tag containing the public key value.
Public Key, Private Key, and PEM Format
The public key and private key are usually generated in PEM format. The private DKIM key is installed in the email service provider, mail server, or sending platform. The public DKIM key becomes part of the DKIM record that you publish in DNS.
A DKIM generator such as the PowerDMARC DKIM Record Generator can help produce the correct public key value and DNS TXT record syntax. However, the generated private key must be handled carefully. Never paste a private key into public DNS, documentation, tickets, or shared chat systems.
Key Type and Hash Algorithm
Most DKIM setup workflows use RSA as the key type, commonly with RSA 2048-bit key length. Some systems may also support Ed25519, though RSA remains the most widely compatible. The hash algorithm is usually SHA-256, which is referenced in the DKIM-Signature header rather than the DNS TXT record itself.
Why the Selector Matters
The selector allows a domain to maintain more than one DKIM record at the same time. This is essential for key rotation, multiple email provider platforms, and segmented email sending sources. For example, Google Workspace, Microsoft 365, and Mailchimp can each use a different selector under the same domain name.
Step-by-Step Guide to Generating and Publishing a DKIM DNS Record
This step-by-step guide applies whether you use Cloudflare, Namecheap, GoDaddy, AWS Route 53, Google Cloud DNS, or another DNS management platform.
1. Choose a DKIM Generator and Enter Domain Details
Start with a DKIM generator or DKIM Record Generator. Enter your domain name, choose a selector, and select the desired key length. If your platform offers both RSA 2048-bit and an older RS 1024-bit option, choose RSA 2048-bit where supported. Some advanced environments may consider a 4096-bit key, but compatibility and DNS record length should be reviewed first.
Tools such as SocketLabs tools are useful when building or validating email infrastructure, especially when you need to coordinate DKIM authentication with broader deliverability settings.
2. Copy the DNS TXT Record
After the DKIM generator creates the DKIM key pair, copy the DNS TXT record. The host or name field usually includes the selector, such as:
selector._domainkey
The value field contains the DKIM record, including the public key. Depending on your DNS configuration, you may need to paste only the selector prefix, or you may need to paste the full hostname. Cloudflare, Namecheap, GoDaddy, Route 53, and Google Cloud DNS all present DNS management fields slightly differently.
3. Add TXT Record in DNS
Go to your DNS provider and add TXT record data exactly as generated. This is the moment when you publish DKIM record information publicly. Make sure the DNS TXT record is not split incorrectly, the quotation marks are handled properly, and the p tag contains the full public key value.
Some ESPs, including Google Workspace and Microsoft 365, generate DKIM records inside their admin consoles. Mailchimp and other marketing platforms may provide a selector and DNS TXT record value that you must add manually. After saving, wait for DNS propagation and activation.
4. Enable DKIM Signing
Once the DNS configuration is live, return to your email provider or ESP and enable DKIM signing. From that point forward, outgoing emails should include a DKIM-Signature header. The mail server signs emails with the private key, and receiving systems use the public key from the DKIM record to verify signature validity.
Best Practices for DKIM Selectors, Key Length, and Record Management
Selector Strategy for Multiple Sending Sources
Use a unique selector for each email sending source. For example, use one selector for Google Workspace, another selector for Microsoft 365, and another for Mailchimp. This prevents one platform’s DKIM key pair from interfering with another and makes troubleshooting easier.
For deeper selector planning, the dmarcian guide to DKIM selectors is helpful when mapping selectors to business units, applications, or ESP platforms. Large organizations, including Fortune 100 enterprises, often use selector naming conventions to identify region, vendor, or environment.
Key Length and Rotation
Key length directly affects cryptographic strength and operational compatibility. RSA 2048-bit is the recommended default for most domains. RS 1024-bit keys are now considered weaker and should be avoided unless a legacy email service provider cannot support stronger keys. A 4096-bit key offers more strength but may create long DNS TXT record values that require careful formatting.
Rotate DKIM keys periodically. During key rotation, create a new DKIM key pair with a new selector, publish the new DKIM record, confirm DNS lookup success, enable DKIM signing with the new private key, and then retire the old selector after mail flow stabilizes.
DNS Configuration Hygiene
Keep records readable and documented. Track each selector, email provider, DKIM key pair creation date, key length, and activation status. Avoid deleting old DKIM records until you are sure no delayed outgoing emails still rely on the previous private key.
Testing, Troubleshooting, and Maintaining Your DKIM Setup
After publishing a DKIM record, testing is essential. A DNS lookup confirms whether the DNS TXT record is visible, but a message-level test confirms whether your email server can sign emails and whether the receiving system can verify signature alignment.
An MXToolbox DKIM Checker can function as a record checker for selector lookups, syntax review, and public key validation. You can also compare results against another DMARCLY DKIM record generator or lookup workflow when diagnosing formatting differences.
Common issues include:
- Wrong selector in the DKIM-Signature header
- Missing or incomplete public key value in the DNS TXT record
- Private key installed in the wrong email server or ESP account
- DNS configuration errors in Cloudflare, GoDaddy, Namecheap, or Route 53
- DKIM record line breaks or quotation issues
- DKIM signing not enabled after DNS publication
- DMARC alignment failures even when DKIM authentication passes
If DKIM authentication fails, inspect the DKIM-Signature header in a delivered message. Confirm the d= domain matches the expected domain name, the s= value matches the selector, and the DNS TXT record exists at selector._domainkey.domain.com. Then verify that the public key matches the private key currently used to sign emails.
For ongoing maintenance, review DKIM setup whenever you add a new ESP, migrate DNS management, change email provider settings, or introduce a new mail server. Coordinate DKIM with SPF and DMARC so every legitimate email sending source supports trusted email delivery. Some platforms also offer an “Email Me the Guide” option or Hosted DKIM service to help administrators preserve setup steps, but the fundamentals remain the same: protect the private key, publish the correct DKIM record, maintain a clean selector strategy, and test every DNS TXT record before relying on it in production.
