What DKIM does
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The receiver fetches your
public key from DNS, at selector._domainkey.yourdomain, and checks the signature. If it matches, the
message really came from a server holding your private key and was not changed on the way.
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…- Selector: a name that lets a domain have several keys at once, one per service or per rotation.
- k=: the key type, almost always
rsa;ed25519is newer and not yet verified everywhere. - p=: the public key. An empty
p=means the key was revoked. - t=y: testing mode; receivers may ignore failures.
Why DKIM matters for DMARC
DKIM survives forwarding, which SPF does not. A signature whose d= domain matches your From address is the
most reliable way to pass DMARC, so every service that sends for you should sign with your domain, not its own.
Check the policy with the DMARC checker, or paste a message's headers into the
header analyzer to see which domain actually signed it.
Questions
How do I find my DKIM selector?
Open the raw headers of a message your domain sent and find the DKIM-Signature header. The s= tag is the selector and d= is the domain. The email header analyzer shows both. Your mail provider's DNS setup page lists it too.
Why does the lookup find nothing when my mail is signed?
Without a selector, the tool tries names that common providers use. Yours may use a different one. Enter the selector from a DKIM-Signature header and it will be found.
Is a 1024-bit key still OK?
It is still accepted by receivers, but 2048-bit has been the recommendation for years. If your provider offers it, rotate to a 2048-bit key under a new selector, wait until the new key is in use, then remove the old record.