DomainKeys Identified Mail, or DKIM, is an email authentication standard that helps prove an email message was authorized by the owner of the sending domain. It works by attaching a cryptographic signature to outgoing emails, allowing the recipient’s email server to verify that the message was not altered in transit and that it aligns with the domain name used to send it.
A properly configured dkim record is essential for protecting an Email Sending Domain against spoofing, phishing, and unauthorized use. Without DKIM, attackers can impersonate your brand more easily, damaging trust with customers, partners, and mailbox providers such as Google and Microsoft.
DKIM is typically used alongside SPF and DMARC as part of a broader email authentication strategy. While Sender Policy Framework (SPF) validates the sending IP address, DKIM validates the message using a dkim key pair consisting of a public key and a private key. The private key is used by the mail server or email provider to sign messages, while the public key is published in DNS so receiving servers can verify the public signature.
For organizations using Google Workspace, Microsoft 365, Mailchimp, a dedicated email server, or a third-party ESP, DKIM helps establish that the email sending source is legitimate. This improves deliverability, supports DMARC alignment, and reduces the likelihood that legitimate outgoing emails will be marked as spam.
How a DKIM Generator Creates Public and Private Keys
A dkim generator creates the cryptographic materials needed for DKIM signing. In most cases, the tool produces an RSA key pair: a private key that stays on the email server or ESP portal, and a public key that is published as a DNS TXT Record. The relationship between the public key and private key allows mailbox providers to validate the authenticity of signed messages.
A dkim record generator tool, such as those provided by EasyDMARC, PowerDMARC, or an email provider, simplifies the process by formatting the public dkim key into the correct dkim record for DNS. This reduces the risk of syntax errors in the dns configuration and helps administrators deploy DKIM more confidently.
The Role of the DKIM Key Pair
The dkim key pair is central to DKIM security. The private key is never meant to be exposed publicly. It is stored by your service provider, mail server, dedicated server, or third-party ESP and used for dkim signing for outgoing messages. If the private key is compromised, an attacker could potentially sign fraudulent emails as if they came from your sending domain.
The public key, by contrast, is intentionally published in DNS. Receiving servers perform a lookup against the selector and domain name in the DKIM-Signature header to retrieve the matching public key. If the signature validates, the message passes DKIM authentication.
Many modern systems use RSA for DKIM, with common key length options such as 1024-bit and 2048-bit. A longer key length generally provides stronger security, although DNS provider limitations should be considered. Today, 2048-bit RSA is widely recommended when supported by your email provider and DNS configuration.
What a DKIM Record Looks Like
A typical dkim record is published as a txt record under a hostname that includes the selector. For example:
selector1._domainkey.example.com
The value usually begins with:
v=DKIM1; k=*rsa*; p=PUBLIC_KEY_VALUE
Basic dkim tag explanations include:
- v=DKIM1: Identifies the record as a DKIM record.
- k=*rsa*: Specifies RSA as the cryptographic algorithm.
- p=: Contains the public key used to verify the public signature.
Some systems may also reference hash algorithms in the DKIM-Signature header, although most administrators primarily manage the dkim record, selector, key length, and public key in DNS.
Step-by-Step Guide to Creating and Publishing DKIM DNS Records
A structured dkim setup helps prevent misconfiguration and makes it easier to test dkim after activation. The following step-by-step guide applies whether you use Google Workspace, Microsoft 365, Mailchimp, a dedicated email server, or a third-party ESP.
1. Identify Your Email Sending Source
Start by confirming which platform sends mail for your domain. This could be an internal Mail Server, an Email Server on a dedicated server, a cloud email provider, or an ESP such as Mailchimp. A business may have several sending systems, and each email sending source may require its own dkim key, selector, and dns configuration.
For example, Google Workspace and Microsoft 365 generate DKIM values in their admin portals, while Mailchimp provides records through its ESP portal. If you manage your own mail server, you may need to generate dkim key material manually or through a DKIM Record Generator.
2. Generate the DKIM Key
Next, use a dkim generator to generate dkim key values. The tool should create a public key and private key using RSA. Choose the appropriate key length, ideally 2048-bit RSA if your DNS provider supports it. If your DNS configuration cannot handle long TXT values cleanly, consult your provider’s documentation before publishing.
The private key is installed on or retained by the email server, service provider, or third-party ESP. The public key becomes part of the dkim record that you publish in DNS.
3. Create and Publish the TXT Record
To publish dkim key information, log in to your DNS host, such as Cloudflare, Namecheap, or another DNS Zone management platform. Create a new DNS TXT Record using the hostname provided by your dkim generator or email provider.
In many DNS zones, the name will look like:
*selector*._domainkey
The value will contain the full dkim record, such as:
v=DKIM1; k=*rsa*; p=your_public_key_here
This is the critical step where you publish dkim public key data for receiving servers to find. Depending on your DNS provider, long public key values may need to be pasted as a single value or split automatically by the interface. Avoid adding extra spaces, quotation marks, or line breaks unless your provider requires them.
DNS Configuration Tips
When editing dns configuration, confirm that you are modifying the authoritative DNS Zone for the correct domain name. If your domain uses Cloudflare for DNS but was purchased at Namecheap, the DKIM TXT Record must be added where the active nameservers point.
Also ensure the selector exactly matches what your email provider expects. A mismatch in the selector is one of the most common reasons a dkim lookup tool or dkim record checker fails to locate the record.
4. Enable DKIM Signing
After publishing the dkim record, return to your ESP portal, Google Workspace Admin Console, Microsoft 365 Defender portal, or mail server configuration and complete DKIM activation. This enables dkim signing on outgoing emails.
Once activation is complete, your platform should begin dkim signing for outgoing messages using the private key. Receiving mailbox providers then retrieve the public key from DNS and validate each message.
Best Practices for DKIM Selectors, Key Length, and Record Management
Strong DKIM implementation depends on more than simply publishing one dkim record. Long-term security requires careful selector management, secure handling of the private key, and periodic review of your dns configuration.
Selector Strategy and Rotation
A selector is a label used to distinguish one dkim key from another under the same sending domain. For example, Google Workspace may use one selector, Microsoft 365 another, and Mailchimp a different selector. This allows multiple email authentication systems to operate simultaneously without overwriting each other.
Use clear selector names that identify the platform or purpose, such as *google*, m365, *mailchimp*, or s1. Avoid reusing the same selector across unrelated systems. If you rotate a dkim key, create a new selector and publish the new public key before disabling the old one.
Key Length and RSA Recommendations
Key length has a direct impact on DKIM security. A 1024-bit RSA dkim key may still work with some providers, but 2048-bit RSA is generally preferred for stronger protection. However, not every DNS interface handles long public key values gracefully, so verify compatibility before changing your configuration.
When possible, use modern defaults offered by your email provider. Google Workspace, Microsoft 365, and many third-party ESP platforms support strong RSA keys. If you operate a dedicated email server, ensure your DKIM software supports the desired key length and secure hash algorithms.
Good record management also means documenting each dkim record, selector, public key, activation date, and related email sending source. This prevents confusion when multiple teams manage DNS, email authentication, and marketing platforms.
