Guides · Updated 2026-10-11
DKIM (DomainKeys Identified Mail) lets a sending service sign each message with a private key. The matching public key is published in DNS at selector._domainkey.yourdomain.com. Receivers fetch the key and verify the signature.
The selector lets one domain have many keys, for example google for Google Workspace, selector1/selector2 for Microsoft 365, and s1/s2 for SendGrid. The selector used is visible in the s= tag of the DKIM-Signature header.
RFC 8301 requires verifiers to reject keys shorter than 1024 bits and says signers should use at least 2048 bits. Use 2048-bit keys where your provider allows it.
DKIM survives forwarding better than SPF, which makes it the most important mechanism for DMARC. The signing domain (d=) must align with your From: domain, so make sure each provider signs with your domain, not theirs.
Publishing a key record with an empty p= value revokes it. Rotate keys periodically and remove keys for services you no longer use.
This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.