How DKIM Works

The basic mechanism

When you send an email, your mail server uses a private key to generate a hash of parts of the message — typically the headers and body. That hash is added to the message as a DKIM-Signature header.

The receiving server looks up your corresponding public key in DNS, uses it to decrypt the signature, and checks whether it matches the message. If the message was tampered with in transit, the signature won't match and DKIM fails.

Your public key lives in DNS at a record like this:

selector1._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE"

The selector1 prefix is set by your email provider. Each provider (or key rotation) gets its own selector, which is why you can have multiple DKIM records on one domain without conflict.

Why DKIM matters more than SPF for forwarding

When a message is forwarded, the envelope sender changes. SPF checks the envelope sender, so SPF fails when mail is forwarded.

DKIM signs the message content itself, not the routing path. As long as the message body and signed headers aren't modified, the DKIM signature survives forwarding. This makes DKIM more durable than SPF and why DKIM alignment alone can cause DMARC to pass.

How to enable DKIM

You configure DKIM inside the service that sends your email — not in your registrar. Every major provider has a setting for this:

1. Go to your email provider's authentication or security settings.
2. Generate or locate the DKIM key.
3. The provider gives you a DNS TXT or CNAME record to add to your domain.
4. Add the record at your DNS registrar or DNS host.
5. Return to the provider and verify or activate DKIM.

The exact steps vary by provider, but the pattern is the same: generate a key pair in the provider, publish the public key in your DNS, then verify. Providers like Google Workspace, Microsoft 365, SendGrid, Mailchimp, HubSpot, and Mailgun all support this.

DKIM and DMARC alignment

DMARC doesn't just check whether DKIM passes — it checks whether the signing domain (d= in the DKIM header) aligns with the visible From: domain.

If you send from billing@yourcompany.com but the message is signed with a key for vendor.com, DKIM passes but DMARC alignment fails. Your vendor needs to sign with a key under your domain, or configure a custom DKIM domain. Most platforms support this through DNS CNAME delegation.

Learn more in DMARC Alignment Explained.

Rotating DKIM keys

Rotating DKIM keys periodically is good practice, especially after a suspected compromise. Most email providers handle key rotation for you. If you manage your own mail infrastructure, generate a new key pair, publish the new selector in DNS, update your mail server to use the new private key, and remove the old selector record after the old signatures have expired (allow at least 48 hours).

Multiple DKIM selectors

You can have multiple DKIM keys active on one domain at the same time. Each uses a different selector name. This is normal when you have multiple services signing mail under your domain. Each DKIM record coexists without conflict because the selector is part of the DNS lookup path.