How to Set Up DKIM | Email Deliverability Guide

How DKIM Works

Unlike SPF which checks the sending server, DKIM signs the email content itself. Here's how it works:

1. Your mail server creates a signature
   Using a private key, the server creates a unique hash of the email headers and body.

2. The signature is added to the email
   A DKIM-Signature header is added containing the signature and selector name.

3. Receiving server looks up your public key
   Using the selector in the signature, it queries selector._domainkey.yourdomain.com.

4. Signature is verified
   The public key decrypts the signature to verify the email hasn't been modified.

Key point: You publish the public key in DNS, but the private key stays with your email provider. You never need to handle the private key directly.

No DKIM Records Found

If we couldn't find any DKIM records, your emails aren't being signed. This doesn't prevent delivery, but it weakens your email authentication and can hurt deliverability, especially when combined with DMARC.

Note: We check common selectors (google, default, selector1, selector2, etc.), but some providers use custom or randomly generated selectors that we can't auto-detect. If your provider (like AWS SES) shows DKIM as "verified," your emails are likely being signed correctly even if our scanner doesn't find them.

How to set up DKIM

DKIM setup is a two-step process:

1. Generate keys — Your email provider generates a public/private key pair
2. Publish the public key — You add a TXT record to your DNS

The exact steps depend on your email provider. See the provider-specific guides below.

DKIM record structure

A DKIM record is published at:

selector._domainkey.yourdomain.com

And looks like:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

DKIM tags explained

• v=DKIM1 — Version (required)
• k=rsa — Key type (usually RSA)
• p=... — The public key (base64 encoded)
• t=s — (Optional) Strict mode, domain must match exactly

Revoked DKIM Keys

A revoked DKIM key has an empty public key (p=). This tells receiving servers that the key is no longer valid, causing DKIM verification to fail for any email signed with that selector.

This is worse than no DKIM: A revoked key actively causes DKIM failures, while a missing record is simply "not found." If DMARC is enforced, emails with failed DKIM may be rejected.

Why keys get revoked

• Key rotation — Old keys are revoked when new ones are deployed
• Security incident — Key was compromised and intentionally invalidated
• Service migration — Old email provider's keys left behind

How to fix

1. Identify the source — Check which email service originally used this selector
2. If still using the service — Generate a new DKIM key and update DNS
3. If no longer using it — Delete the revoked record from DNS

Safe to delete: If you've migrated away from an email service, you can safely delete their old DKIM records. They're no longer needed.

Setup by Email Provider

Each email provider has their own DKIM setup process. Here are guides for the most common providers:

Google Workspace

1. Go to Admin console → Apps → Google Workspace → Gmail → Authenticate email
2. Click "Generate new record"
3. Choose key length (2048-bit recommended)
4. Copy the generated TXT record value
5. In your DNS, create a TXT record at google._domainkey
6. Return to Admin console and click "Start authentication"

Google's official guide

Microsoft 365

1. Go to Microsoft 365 Defender → Email & collaboration → Policies → DKIM
2. Select your domain
3. Microsoft will show you two CNAME records to add
4. Add the CNAME records to your DNS
5. Return to Microsoft 365 and enable DKIM signing

Microsoft's official guide

Note: Microsoft 365 uses CNAME records that point to Microsoft's servers, rather than direct TXT records. This allows Microsoft to rotate keys automatically.

SendGrid

1. Go to Settings → Sender Authentication
2. Click "Authenticate Your Domain"
3. Choose your DNS provider
4. SendGrid will generate three CNAME records
5. Add all three to your DNS
6. Return to SendGrid and verify

SendGrid's official guide

Mailchimp / Mandrill

1. Go to Settings → Domains → Verify
2. Click "View DKIM settings"
3. Copy the provided TXT record
4. Add it to your DNS at the specified hostname
5. Return to Mailchimp and verify

Mailchimp's official guide

Amazon SES

1. Go to SES Console → Verified identities → your domain
2. Go to the "Authentication" tab
3. Click "Publish DNS records" under DKIM
4. If using Route 53, records can be auto-published
5. Otherwise, add the three CNAME records manually

AWS SES official guide

Why our scanner may not detect AWS SES DKIM: SES uses randomly generated selector names (like abc123) instead of common ones. If SES shows DKIM as "verified" in your console, your emails are being signed correctly. You can also verify by sending a test email and checking the headers for dkim=pass.

Verify your changes

After making changes, use our checker to confirm everything is configured correctly.