DKIM setup and configuration
DKIM puts a digital signature on every email you send. Receivers check it against a key in your DNS, which proves the email really came from your domain and wasn’t changed on the way.
The short answer
DKIM (DomainKeys Identified Mail) signs each outgoing email with a private key held by your email provider; receivers verify the signature with a public key you publish in DNS [1]. It survives forwarding, unlike SPF, and it is the most reliable way to pass DMARC. We switch it on for every service that sends as your domain, with 2048-bit keys where supported [2].
What’s included
- DKIM switched on in Google Workspace or Microsoft 365, and in every other service that sends as your domain.
- The public keys published in your DNS under the right selectors.
- 2048-bit keys wherever the provider supports them.
- Checks that each service signs with your domain, not the provider’s, so it counts for DMARC.
- A key rotation plan for services where you control the keys.
- Tests from each sender, with the signatures verified.
How we do it
- List every service that sends as your domain.
- Generate or activate the DKIM keys in each service.
- Publish the DNS records for each selector.
- Switch on signing and send test emails.
- Verify the signatures and DMARC alignment in the received headers.
Key length matters
Older setups often use 1024-bit keys. The current DKIM standard requires at least 1024 bits for verifiers and recommends 2048 bits for signers [2]. Some DNS providers struggle with the longer record; we split it correctly where needed so it works.
The most common DKIM gaps
- Google Workspace or Microsoft 365 set up years ago without DKIM ever being switched on.
- A marketing tool signing with its own domain, so DKIM passes but doesn’t count for your DMARC.
- A DNS record pasted with a line break or missing quotes, so the key can’t be read.
- Keys never rotated since the account was created.
Common questions
Doesn’t my email provider do DKIM automatically?
Often not for your own domain. Google Workspace and Microsoft 365, for example, need DKIM switched on and a record published for your domain before your messages are signed with it.
What is a DKIM selector?
A name that lets one domain have several DKIM keys, one per sending service. Each service tells you its selector; the key is published at selector._domainkey.yourdomain.com [1].
Do I still need SPF if I have DKIM?
Yes. Each covers gaps in the other, and DMARC works best with both passing. Gmail and Outlook’s rules for larger senders require both.
Sources
Numbers in this guide come from these studies and publications. Links open the original.