DKIM Record Generator

What Is DKIM and How Does It Work?

DKIM (DomainKeys Identified Mail) is an email authentication method that allows the sender to cryptographically sign each outgoing message. The receiving mail server verifies this signature using a public key published in the sender's DNS. A valid DKIM signature proves two things: the message actually came from the stated domain, and the message was not altered in transit.

Unlike SPF, which checks the sending IP against an allowed list, DKIM works by attaching a digital signature to the message itself. This means DKIM verification survives mail forwarding, where SPF often fails because the forwarding server's IP is not in the original SPF record.

Understanding the DKIM DNS Record Format

A DKIM record is a DNS TXT record published at a specific subdomain: selector._domainkey.yourdomain.com. The selector is a label you choose — common values are mail, google, s1, or default. The record value starts with v=DKIM1; k=rsa; p= followed by your base64-encoded public key.

The private key is kept secret on your mail server or managed by your email service provider. The public key is what you publish in DNS. Receiving servers use the public key to verify signatures created by the private key — the classic public-key cryptography pattern.

Where to Find Your DKIM Public Key

Your DKIM public key is generated by your mail provider when you enable DKIM signing. Here is where to find it for the most common providers:

• Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a new key and copy the TXT record value.
• Microsoft 365: Exchange admin center → Protection → DKIM. Enable DKIM for your domain and copy the CNAME records (Microsoft uses CNAMEs, not direct TXT records).
• Mailchimp: Account → Domains → Verify a domain. Mailchimp provides the DKIM TXT record value to add to your DNS.
• SendGrid: Settings → Sender Authentication → Domain Authentication. SendGrid generates the full DKIM TXT record for you.
• Self-hosted (Postfix, Exim): Use opendkim-genkey to generate a key pair. The public key file contains the TXT record value.

DKIM Best Practices

Use a 2048-bit key length when possible — 1024-bit keys are considered weak and may be flagged by some mail systems. Rotate your DKIM keys periodically (at least annually) to limit exposure if a key is ever compromised. Keep the old key in DNS for a few days after rotating to allow in-flight messages to be verified.

DKIM alone does not protect the visible From header. To complete your email authentication setup, add a DMARC policy that aligns DKIM results with the From domain. A clean email list also matters — even authenticated mail lands in spam if it bounces repeatedly. Use email verification to remove invalid addresses, or verify large lists with bulk email verification.