Question 1

What is DKIM?

Accepted Answer

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outbound email. The sending mail server signs the email with a private key, and receiving servers verify the signature against the public key published in DNS as a TXT record. This proves the email was sent by an authorised server and was not modified in transit.

Question 2

What is a DKIM selector?

Accepted Answer

A DKIM selector is a label that allows a domain to have multiple DKIM keys. The selector is included in the DKIM-Signature header of each email and tells receivers which DNS record to look up. For example, selector "google" is looked up at google._domainkey.domain.com. Common selectors include: google, k1, mail, default, s1, s2.

Question 3

How do I find my DKIM selector?

Accepted Answer

Look at the headers of an email sent from your domain. Find the DKIM-Signature header — it contains s= followed by the selector. You can view email headers in Gmail (Show Original), Outlook (Message Source), or Apple Mail (All Headers).

Question 4

What DKIM key size should I use?

Accepted Answer

Use a minimum of 2048-bit RSA keys. 1024-bit keys are considered weak and can be factored. For maximum security, use 2048-bit or 4096-bit keys. Ed25519 keys are also increasingly supported and provide stronger security at smaller key sizes.

Question 5

Why does DKIM matter for email deliverability?

Accepted Answer

Major providers (Google, Microsoft, Yahoo) use DKIM as a key signal for inbox vs spam placement. DKIM also enables DMARC alignment on the From header, which is the identifier users actually see. Without DKIM, emails are more likely to be flagged or rejected, especially since Google and Yahoo's 2024 bulk sender requirements.

DKIM Record Checker

Frequently Asked Questions