What is a DKIM record?

What is a DKIM record?

DKIM, which stands for DomainKeys Identified Mail, is an email authentication method that adds a digital signature to every message you send. A DKIM record is the DNS (Domain Name System) record that publishes the public key receiving servers use to check that signature.

When the signature checks out, the receiving server knows two things: the message was authorized by the domain that signed it, and its content wasn't changed in transit. DKIM works alongside SPF and DMARC to protect your domain from spoofing and help your email reach the inbox.

How does DKIM work?

1. Signing: Your sending server creates a cryptographic signature using a private key. The signature covers the message body and selected headers, such as From, Subject and Date.
2. DKIM header: The server adds a DKIM-Signature header to the email. It includes the signing domain (d=) and a selector (s=) that tells receivers where to find the public key.
3. DNS lookup: The receiving server looks up the public key at selector._domainkey.yourdomain.com in DNS.
4. Verification: The receiver uses the public key to check the signature. If it matches, DKIM passes. If anything in the signed content changed, or the key can't be found, DKIM fails.

What a DKIM record looks like

A DKIM record is a TXT record published at a name made of a selector, the word _domainkey and your domain. For example:

Selectors let one domain have several DKIM keys at once, such as one for your email marketing platform and another for your company mailboxes. That also makes it possible to rotate keys without interrupting mail.

Why DKIM matters for deliverability

DKIM is no longer optional for marketing email. The major mailbox providers now require authentication:

Sources: Google sender guidelines, dmarcian on Microsoft's requirements. Learn more about the Gmail and Yahoo inbox protection rules.

What happens if DKIM is missing or invalid?

If a message has no DKIM signature, or the signature fails, the receiving server is more likely to treat it with suspicion. It may land in spam or, under stricter bulk-sender rules, be rejected entirely. If your DMARC policy is set to quarantine or reject, failing both DKIM and SPF alignment means your own legitimate email can be blocked.

Common causes of DKIM failures include:

• The DKIM record was never published, or was entered with a typo or line break
• The selector in the email doesn't match the record name in DNS
• A key was rotated in the sending platform but not updated in DNS
• A mailing list or forwarding service modified the message after it was signed
• The signing domain doesn't align with your From domain, so DMARC fails even though DKIM passes

DKIM best practices

Key size guidance comes from RFC 8301, which requires signers to use RSA keys of at least 1024 bits, recommends at least 2048 bits, and retires rsa-sha1.

How to check your DKIM

Send an email to a Gmail account, open it, and choose Show original. Look for DKIM: PASS along with the signing domain. In other mail apps, look in the full message headers for an Authentication-Results line containing dkim=pass.

Setting up DKIM in DailyStory

DailyStory sends from a dedicated subdomain of your domain and provides the DKIM and SPF records you need. Add them at your DNS provider, and DailyStory shows a green check when each record is verified, usually within 20 to 30 minutes. Find step-by-step instructions in Setting up your email domain and Configuring SPF, DKIM and DMARC.

What is the future of DKIM?

A successor called DKIM2 is being developed by the IETF's DKIM working group. It reuses existing DKIM keys and adds a cryptographic chain of custody across forwarding hops, envelope binding to prevent replay attacks, and secure handling of delayed bounces.

As of September 2026, DKIM2 is still a set of Internet-Drafts, not a finished standard, and mailbox providers don't require it. See the latest DKIM2 best practices draft. For now, a correctly configured DKIM setup remains the requirement.

Frequently asked questions