How to Set Up DKIM Signing

DKIM (DomainKeys Identified Mail) cryptographically signs every email you send so receivers can verify the message wasn't altered and genuinely came from your domain. Without DKIM, your mail looks suspicious to Gmail, Outlook, Yahoo — and you'll see it land in spam.

Try our Email checker

1. Pick a selector name

A DKIM selector is just a label used to publish the public key at._domainkey.. Use a meaningful name like 's1' 'mail2024' or your provider's default ('google' for Workspace 'selector1' for Microsoft 365).

2. Generate a 2048-bit key pair

Most ESPs (Google Workspace Microsoft 365 SendGrid Mailgun) generate the key for you in their admin console. If you're rolling your own run: openssl genrsa -out dkim_private.key 2048 && openssl rsa -in dkim_private.key -pubout -out dkim_public.key. Keep the private key on the mail server only.

3. Publish the public key as a TXT record

Add a TXT record at._domainkey. with value: v=DKIM1; k=rsa; p=. The value can exceed 255 chars — use multiple quoted strings if your DNS provider requires it.

4. Configure your mail server to sign

OpenDKIM Postfix DKIM milter or your ESP's signing module — all need: the selector name the domain and a path to the private key. Test by sending a message to a Gmail inbox and viewing 'Show Original' — look for 'dkim=pass'.

5. Rotate yearly

Generate a new key (e.g. selector 's2') publish switch your mail server to sign with the new selector then remove the old TXT record after a few weeks. Don't reuse selectors.

FAQ

Should I use 1024-bit or 2048-bit keys?+

2048-bit. 1024-bit was deprecated in 2017 and some receivers downgrade or reject it.

Do I need DKIM if I have SPF?+

Yes. SPF authenticates the sending IP. DKIM authenticates the message content. DMARC requires at least one to align with the From header — DKIM is more reliable through forwarding.

Want to verify your setup?

Run the check now