DKIM is the cryptographic signature that proves an email really came from its domain and was not altered on the way. This guide explains how signing and verification work, the selector._domainkey TXT record, and how DKIM works alongside SPF and DMARC.
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to a message. The sender signs it with a private key; the receiver fetches the matching public key from DNS and verifies the signature - proving the message was not altered in transit and genuinely came from the domain.
DKIM is a sign-then-verify handshake between the sending and receiving servers:
The sending server hashes selected headers and the message body, then signs that hash with a private key and adds a DKIM-Signature header to the message.
The matching public key is published in DNS as a TXT record at selector._domainkey.yourdomain.com. The selector lets one domain run several keys for different providers.
The receiving server reads the selector from the DKIM-Signature header, fetches the public key from DNS, and verifies the signature and body hash. If either was changed, verification fails.
A DKIM pass that is aligned with the visible From domain satisfies DMARC - even when SPF fails, which is common for forwarded mail and mailing lists.
The DKIM public key lives in a DNS TXT record under the selector named in the message's signature:
A missing or malformed public key means every signature fails verification, so DKIM effectively does nothing. Rotate keys periodically and keep the record complete. See the full DKIM setup guide for provider-specific steps.
DKIM is one of three records that work as a set. Each answers a different question:
SPF
DKIM
DMARC
When BounceZero checks an address, the sending domain's authentication posture is one of the signals it reads. A domain with valid DKIM, SPF and an enforcing DMARC policy is a far more trustworthy sender than one with none of them. It is one input among many, not a verdict on its own.
Check any domain's DKIM record in seconds with the free BounceZero DKIM Checker.
DKIM (DomainKeys Identified Mail) is an email authentication method that attaches a cryptographic signature to outgoing messages. The receiving server fetches the sender's public key from DNS and verifies the signature, confirming the message was not tampered with in transit and truly came from the domain that signed it.
SPF authorises which servers may send for a domain by checking the sending IP against a DNS list. DKIM instead cryptographically signs the message itself, so it survives forwarding (which usually breaks SPF). Most domains publish both, and DMARC ties them together with alignment.
A selector is a label in the DKIM-Signature header (the s= tag) that tells the receiver which public key to look up. The key lives in DNS at selector._domainkey.yourdomain.com, so one domain can publish several keys (for different providers) under different selectors.
Read the selector from a message's DKIM-Signature header, then query the TXT record: `dig TXT selector._domainkey.example.com`, or use a free DKIM checker. BounceZero's DKIM Checker looks up the public key and confirms the record is valid and complete.
DNS intelligence, SMTP probes and ML scoring in one pipeline. 100 free verifications.
Start FreeProvider behaviour, DNS setup, warm-up, and inbox placement
Hard vs soft bounces, ISP thresholds, 6-step reduction plan, benchmarks, suppression list management
How DMARC works with SPF and DKIM to stop spoofing - policy, alignment, reporting
Temporary 4xx deferral of unknown senders - why it delays mail and means unknown, not invalid
SPF, DKIM and DMARC explained - the DNS records that prove your mail is genuine
Sender Policy Framework explained - syntax, includes, the 10-lookup limit
How mail routing works and why MX lookups matter for verification
Continue through related topics
Follow BounceZero