What Is DKIM? Email Signing Explained Simply
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The sending server signs selected headers and a body hash with a private key, and receivers verify it against a public key in your DNS at selector._domainkey.yourdomain. It proves the mail came from your domain unaltered; with SPF it underpins DMARC.
For domain owners and IT admins setting up email authentication on cPanel, Google Workspace or Microsoft 365 to stop spoofing and spam-folder delivery.
knowledge
- Read time
- 6 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What problem does DKIM solve for a sending domain?
DKIM (DomainKeys Identified Mail, RFC 6376) is an email authentication standard that adds a digital signature to every outgoing message, so receiving servers can confirm the mail was authorised by your domain and was not altered on the way. Receivers check the signature against a public key you publish in DNS.
Without a signature, anyone who knows your address can put your domain in the From line and send a fake invoice or payment request. DKIM gives the receiver a way to tell a real message from a forgery. It does not encrypt mail and it does not stop every spam message; it proves two narrower things — the signing domain authorised the signature, and the signed content arrived intact.
- Forgery: a forged message fails when the receiver cannot match a signature to your published key.
- Tampering: content edited in transit produces a different body hash, so verification fails.
- Reputation: mail that passes DKIM is treated as more trustworthy than unauthenticated mail.
How do DKIM signing and verification work?
The sending server hashes the body and selected headers, signs the result with a private key and adds a DKIM-Signature header; the receiver fetches the matching public key from DNS and reruns the same check.
- The sender builds a body hash (
bh=) and a hash over the header fields it lists. - It signs them with the private key and writes the signature (
b=), signing domain (d=), selector (s=), header list (h=) and algorithm (a=) into the DKIM-Signature header. - The receiver reads
d=ands=and queriess._domainkey.din DNS for the public key. - It recomputes the hashes and compares: a match returns
dkim=pass, any mismatchdkim=fail.
What does a DKIM DNS record look like?
A DKIM record is a TXT record published at selector._domainkey.yourdomain that holds only the public key; the private key stays on the sending server and is never put in DNS.
default._domainkey.example.in. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."| Tag | Meaning |
|---|---|
v=DKIM1 | Record version; always present |
k=rsa | Key type; RSA is near-universal, Ed25519 (RFC 8463) is supported by some receivers |
p= | The base64 public key; a 2048-bit key is the current recommendation and gives a much longer string than 1024-bit |
t=y | Testing mode; receivers should not treat failures differently |
t=s | Strict: the signer identity must use the d= domain itself, not a subdomain |
The DKIM-Signature header on each message is separate from this record. It carries v=1, a=rsa-sha256, d=, s=, h=, bh= and b=. Long keys sometimes have to be split into several quoted strings in one TXT record; see what is a TXT record.
How does DKIM work with SPF and DMARC?
SPF checks which IP address delivered the mail, DKIM checks the signature inside it, and DMARC passes when at least one of them aligns with the domain in the visible From line. DMARC's policy then tells receivers what to do when neither aligns.
Alignment is the part most setups miss. A message signed with d=mail.provider.com while the From line says yourdomain.in passes DKIM but is not aligned, so it does not satisfy DMARC until you sign with your own domain.
- SPF authorises sending IPs in one TXT record at the domain root.
- DKIM signs the content, so it can survive forwarding that breaks the SPF check.
- DMARC publishes
p=none,p=quarantineorp=rejectat_dmarc.yourdomainand requests aggregate reports.
Publish them in that order and start DMARC at p=none so you can read reports before enforcing. The SPF and DMARC setup guide covers syntax and reporting addresses.
How do you enable DKIM on cPanel and Google Workspace?
In cPanel, Email Deliverability installs the suggested DKIM record and turns signing on; in Google Workspace, the Admin console generates the key, you publish the TXT record, and you then click Start authentication.
On cPanel:
- Open Email Deliverability in the Email section.
- Find the domain, check its DKIM status, and choose Install the suggested record if it is missing or invalid.
- Note the selector (often
default) and confirm the TXT record resolves before testing.
On Google Workspace:
- In the Admin console, go to Apps › Google Workspace › Gmail › Authenticate email.
- Choose a 2048-bit key and a selector prefix (default
google), then generate the record. - Add the TXT record at your DNS host, wait for propagation, then click Start authentication.
Microsoft 365 uses two CNAME records (selector1 and selector2) instead of a TXT record and is enabled from the Defender portal's DKIM settings. If your mailboxes are on WebJi® business email hosting or Google Workspace via WebJi®, support@webji.services can publish the record and confirm it resolves.
How do you test whether DKIM passes?
Send a message to a Gmail account you control, open it, choose Show original, and look for dkim=pass with header.d= set to your own domain. A pass on your domain, not the provider's, is the result DMARC needs.
dig TXT default._domainkey.example.in +shortThat query should return the v=DKIM1 string; an empty answer means the record is missing, at the wrong hostname, or still behind an old TTL.
- dkim=pass with your domain: signature and DNS record both work.
- dkim=pass with a provider domain: signed but not aligned for DMARC.
- dkim=none: the message carries no signature at all.
- dkim=fail: key mismatch, an edited message, or two TXT records at the same selector.
Two TXT records at one selector break verification because receivers may read the wrong key. Delete the stale record rather than adding a second one.
Why does DKIM fail on forwarded and mailing-list email?
Forwarders and mailing lists often change the subject, add a footer or rewrite headers, and any change to a signed field invalidates the signature even when the original sender configured everything correctly.
Practical fixes are relaxed canonicalisation (c=relaxed/relaxed) so small whitespace changes do not break the hash, a separate selector for each sending service so failures are traceable, and DMARC reports so the failing path becomes visible. ARC (Authenticated Received Chain) seals help with some forwarders, but receiver support is uneven. Forwarding itself is explained in what is email forwarding.
Frequently asked questions
Is DKIM required for Gmail delivery?
Google's sender guidelines require everyone sending to Gmail to use SPF or DKIM. Bulk senders, roughly 5,000 or more messages a day to Gmail accounts, must use SPF, DKIM and a DMARC record. Unsigned mail from smaller senders is not blocked outright but is filtered more aggressively.
What is a DKIM selector?
A selector names the key pair used to sign a message. It appears as s= in the signature and as the first label of the DNS record, so a selector of default gives default._domainkey.yourdomain. Using one selector per sending service lets you rotate keys independently.
How often should DKIM keys be rotated?
Many providers suggest every six to twelve months, and immediately if a private key may have leaked. Publish the new selector first, switch signing to it, then remove the old record after a few days so in-flight mail still verifies.
What is the difference between DKIM and SPF?
SPF lists the IP addresses allowed to send for a domain and is checked against the connecting server. DKIM signs the message content and is checked against a public key in DNS, so it can still verify after some forwarding paths that break SPF.
Checked against RFC 6376 and Google sender guidelines, 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.