What is a DKIM Record?
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to prove that an email was sent from your domain and hasn't been tampered with in transit. It works by adding a cryptographic signature to outgoing emails, which recipients can verify against a public key published in your DNS.
How DKIM Works
When you send an email, your mail server signs the message using a private key. The recipient's server fetches the corresponding public key from your DNS using a TXT record at selector._domainkey.yourdomain.com and verifies the signature. If the signature matches, the email is considered authentic.
DKIM Selectors Explained
A DKIM selector is a string that identifies which DKIM key pair to use. It appears in both the email header and the DNS record name. Common selectors include google (for Google Workspace), s1/s2 (for many ESPs), mail, default, and selector1/selector2 (for Microsoft 365). You can have multiple selectors to support different mail senders or for key rotation.
Why DKIM Matters for Deliverability
Without DKIM, your emails are more likely to land in spam folders. DKIM works alongside SPF and DMARC to form a complete email authentication framework. Gmail, Outlook, and Yahoo all use DKIM verification when scoring incoming messages. A valid DKIM signature significantly improves your sender reputation.
DKIM Record Format
A typical DKIM TXT record looks like: v=DKIM1; k=rsa; p=MIGfMA0GCSq.... The v field is the version, k is the key type (rsa or ed25519), and p is the base64-encoded public key. An empty p field means DKIM is intentionally disabled for that selector.