DKIM signature (DomainKeys Identified Mail)

DKIM (DomainKeys Identified Mail) is a digital signature that your mail server attaches to every outgoing message. If you are asking what a DKIM record is, think of a wax seal on an old letter - if the seal is intact, the recipient knows the letter is genuine and nobody opened or swapped it along the way.

The mechanism relies on a key pair: the private key stays on your sending server and signs the mail, while you publish the public key in DNS. The recipient server fetches the public key, verifies the DKIM signature in the message header, and confirms two things at once: that the mail truly comes from your domain and that its content was not modified in transit.

In practice, a DKIM record is a TXT entry (sometimes a CNAME) published under a specific name, selector._domainkey.yourdomain.com. The selector is a label that lets you hold several keys at once (for example, a separate one for Google Workspace and another for your newsletter system). DKIM works best paired with SPF and supervised by DMARC - only together do they form complete email protection.

You can verify whether your DKIM public key is correctly published in DNS with our free DNS Lookup tool at /dns (by providing the selector name).