Guides › DKIM
What is DKIM? How email signing works
DKIM (RFC 6376) adds a cryptographic signature to every message. The receiver looks up the public key in DNS at <selector>._domainkey.<domain> and verifies the signature, proving the message wasn't altered and was authorised by that domain.
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; ...
d= is the signing domain and s= is the selector. The key lives at google._domainkey.example.com:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
- Each sending service should sign with your domain (d=yourdomain.com) for DMARC alignment.
- Use 2048-bit RSA keys. 1024-bit still works but is weaker.
- An empty
p=means the key has been revoked. - You can have many selectors: one per service, or rotating pairs.
Check your domain now