How to Set Up DKIM

DKIM uses a public/private key pair. Your mail server holds the private key and signs each outgoing message; you publish the matching public key in DNS. The receiver reads the DKIM-Signature header, fetches the public key, and verifies the signature. If it matches, the message is authentic and unchanged.

The public key lives in a TXT record named with a selector:

1. Generate a key pair. Almost every email platform generates DKIM keys for you — look for "DKIM" or "email authentication" in its admin settings. Choose a 2048-bit key where offered.
2. Copy the public key and selector. The provider gives you a host name (containing ._domainkey) and a TXT value.
3. Publish the TXT record exactly as provided in your DNS. Some providers split long keys across quoted strings — paste it verbatim.
4. Enable signing back in the email platform once the record resolves. Outgoing mail will then carry a DKIM signature.
5. Test by sending a message to a mailbox and checking that DKIM passes in the headers.

Selectors let you publish more than one key at a time, which makes rotation painless: publish a new selector, switch signing to it, then retire the old one. Each sending service typically uses its own selector, so a domain often has several ._domainkey records — one per platform.

A missing or malformed DKIM record silently breaks authentication. ZoneWatcher's DKIM monitor validates your selector records so a botched edit or an expired key does not go unnoticed.

DKIM is most effective alongside SPF and DMARC — DMARC is what ties a DKIM pass to your visible From address. See SPF vs DKIM vs DMARC.