DKIM (DomainKeys Identified Mail) is a cryptographic signature that proves your emails were not tampered with in transit and that your domain authorised the send. Without a valid DKIM record, Gmail, Outlook, and Yahoo treat your emails as higher risk - and since 2024, DKIM is mandatory for bulk senders. This guide covers setup for Google Workspace, Microsoft 365, and custom SMTP configurations.
DKIM uses public-key cryptography. You generate a key pair: the private key stays on your mail server and signs every outgoing email. The public key is published in DNS as a TXT record. When a receiving mail server gets your email, it fetches the public key from DNS and verifies the signature.
Stays on your mail server. Signs the email headers and body hash. Never shared, never in DNS.
Published in DNS as a TXT record at selector._domainkey.yourdomain.com. Anyone can read it to verify signatures.
Added to every outgoing email. Contains the selector name, algorithm, signed headers, and the signature itself.
Receiving server fetches your public key from DNS, recomputes the hash, compares to the signature. Pass = authenticated.
admin.google.com › Apps › Google Workspace › Gmail › Authenticate email
Choose 2048-bit key length. Set a selector name - Google uses “google” by default, but you can use any string (e.g. “mail2026”).
Google gives you the full hostname and value. The hostname looks like: google._domainkey.yourdomain.com
In Cloudflare, GoDaddy, Namecheap, or your registrar: add a TXT record with the hostname and value Google provided. TTL 3600 is fine.
Google will verify the DNS record and enable DKIM signing for all outgoing mail.
security.microsoft.com › Email & Collaboration › Policies & Rules › Threat Policies › Email Authentication Settings › DKIM
M365 generates the key pair automatically. It shows you two CNAME records (not TXT records - this is different from Google).
M365 uses CNAME records that point to Microsoft’s infrastructure. Hostname format: selector1._domainkey.yourdomain.com
Return to the DKIM settings page and click Enable again once DNS has propagated. The status should change to Enabled.
For custom SMTP setups (Postfix, Exim, PowerMTA), you generate the key pair yourself and publish the public key as a TXT record:
Hostname: mail._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
(your 2048-bit public key here)
v=DKIM1
Version tag - always DKIM1
k=rsa
Key type - RSA is standard
p=...
Base64-encoded public key
| Method | How | What to look for |
|---|---|---|
| MXToolbox DKIM Lookup | mxtoolbox.com/dkim › enter domain + selector name | “DKIM Record Published” in green; public key displayed |
| dig command | dig TXT selector._domainkey.yourdomain.com |
ANSWER section shows the p= public key value |
| Gmail header check | Send yourself an email › Gmail › three dots › Show original | Authentication-Results: dkim=pass (2048-bit key) |
| Mail-Tester.com | Send to the test address shown at mail-tester.com | DKIM section shows green pass; 10/10 score possible |
| Google Admin (for Workspace) | Admin Console › Gmail › Authenticate email | Status shows “Authenticating email” in green |
1024-bit is deprecated. Google, Yahoo, and security scanners flag it. Always generate 2048-bit. If your current key is 1024-bit, rotate it: generate a new 2048-bit key with a new selector, publish both, then remove the old one after 48 hours.
The hostname in DNS must exactly match the “s=” tag in the DKIM-Signature header. If your mail server signs with s=google but your DNS record is at s=mail, verification fails.
Every domain you send email from needs its own DKIM record. Sending domains (e.g. trybouncezero.io) need DKIM too, not just the main domain.
If a mailing list, forwarding service, or spam filter modifies the email body or headers after signing, DKIM breaks. Exclude mailing list additions from the signed headers, or use ARC (Authenticated Received Chain) for forwarding.
DKIM alone prevents tampering but DMARC is what tells receiving servers what to do when DKIM fails. Always pair DKIM with a DMARC record (start with p=none).
A valid DKIM record protects your authentication. A clean list protects your bounce rate. Both matter for deliverability. Verify before every campaign - 100 free credits, no card required.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Provider behaviour, DNS setup, warm-up, and inbox placement
How to check, protect, and repair your sending reputation
Min age before cold email, warmup vs age, new domain setup checklist
SPF syntax, provider includes, 10-lookup limit fix, ~all vs -all explained
DNS records, DMARC policy progression, verification commands, cold email setup
How to set up SPF, DKIM, and DMARC in 2026: exact DNS records, verification commands, common
How to warm up a new email domain in 2026: the right tool, a realistic 30-day timeline
Continue through related topics