DKIM

DKIM Record Setup Guide

How DKIM signing works, why it survives forwarding when SPF does not, and how to rotate a key safely.

Gerador de Registro DKIMRode no seu próprio domínio primeiro. Grátis, sem conta.

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The receiving server verifies it against a public key published in your DNS, proving the message really came from your domain and was not altered in transit.

How DKIM helps deliverability

DKIM is one of the three authentication checks (with SPF and DMARC) that mailbox providers use to decide whether to trust your mail. A valid DKIM signature is required to pass DMARC by alignment, and Google and Yahoo now require it for bulk senders.

Using the generated record

Publish the generated public key as a TXT record at selector._domainkey.yourdomain.com, keep the matching private key in your sending platform, and confirm the signature passes before depending on it.

Why DKIM survives forwarding when SPF does not

SPF checks the server that handed over the message, so a forwarding server breaks it. DKIM signs the message itself, so the signature still verifies after a hop, as long as nothing rewrote the body or the signed headers. That is why mailing lists that append footers break DKIM and plain forwarders usually do not.

Rotating a DKIM key safely

Publish the new key on a new selector first, switch your sending platform to sign with it, wait until no mail is signed with the old selector, and only then remove the old record. Deleting the old key too early makes every message still in flight fail verification.

Check yours now

Generate the record with the free DKIM record generator, publish it, then send yourself a message and paste the raw headers into the free email header analyzer. The Authentication-Results line is the receiver’s own verdict, and it is the only one that settles whether DKIM is passing.

How to publish a DKIM record

Generate a DKIM key pair, publish the public key in DNS and verify the signature.

Pick a selectorChoose a short label such as s1 or mail. It identifies which key receivers should use, and lets you publish several keys at once.
Get the public keyMost sending platforms generate the key pair for you and show the public half. If yours does not, generate a 2048-bit RSA key and keep the private half in the platform.
Publish the TXT recordCreate a TXT record at selector._domainkey.yourdomain.com with the generated value. Watch for DNS providers that split long values, which is a common cause of silent failure.
Enable signingTurn on DKIM signing in the sending platform and send yourself a test message.
Verify the signaturePaste the raw headers of that test message into the email header analyzer and confirm the Authentication-Results line reads dkim=pass.

Perguntas frequentes

What is a DKIM selector?

A selector is a label (e.g. "google" or "s1") that tells receivers which DKIM public key to use. It lets you publish multiple keys and rotate them safely.

Is DKIM required?

For bulk senders to Gmail and Yahoo, yes. For everyone, DKIM significantly improves trust and is needed to pass DMARC by DKIM alignment.

How long should my DKIM key be?

Use at least a 2048-bit RSA key where your provider supports it; 1024-bit is the minimum but weaker.

Why is my DKIM failing?

Common causes are a mismatched selector, the record split or truncated in DNS, or the message being modified by a mailing list after signing. Use an email header analyzer to see the exact DKIM result.

How do I test my DKIM record?

Send yourself a message and paste its raw headers into the free email header analyzer. The Authentication-Results header shows dkim=pass or dkim=fail with the domain and selector that were checked.

Can I have more than one DKIM selector?

Yes, and you usually should. Each sending platform can sign with its own selector, and rotation works by publishing the new selector before retiring the old one.

Mais guias

Estas ferramentas respondem a pergunta uma vez. O monitoramento contínuo reverifica seu domínio a cada 6 horas e avisa quando a resposta muda, a partir de $14/mês. Preços