What DKIM does
DKIM adds a digital signature to every mail. Receivers can tell that the mail really comes from your domain and was not changed on the way.
How it works
DKIM (DomainKeys Identified Mail) works with a key pair. The private key stays with the sending system and signs every mail. The public key is a TXT record in DNS; the receiver uses it to verify the signature.
The key lives at <selector>._domainkey.<your domain>. The sending system chooses the selector, a name such as selector1 or google. Each service you send through gets its own key and selector.
Selectors cannot be listed from outside. A check without a test mail can therefore only try common names. Enter your selector, or send a test mail: it is in the signature.
What matters
- Key length 2048 bit. 1024 bit is still accepted, shorter keys are not.
- No test mode. With
t=yin the record, receivers treat the signature as absent. - Sign with your own domain. If the service signs with its domain instead of yours, DKIM passes but does not count for DMARC.
- Rotate keys. Create a new selector, switch sending over, then empty the old record (
p=).
How to set it up
Your mail or newsletter provider shows the record in its admin area, usually as TXT or CNAME. Enter it in the DNS settings of your domain, yourself or through your agency, then switch on signing at the provider. Do this for every service that sends in your name.