DKIMDomainKeys Identified Mail
By Federico Donatone · Updated October 15, 2026DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to every outgoing message. The receiving server uses a public key published in the sender's DNS to check that signature. A valid signature proves the email came from that domain and was not altered on the way.
What is DKIM and how does it work
DKIM works with a pair of keys. Your mail server keeps a private key and uses it to sign each outgoing email: it takes a fingerprint of the headers and body and attaches it as a DKIM-Signature header. The matching public key sits in DNS, the public address book of the internet, where any receiver can fetch it.
- Your server signs the email and adds a DKIM-Signature header that names the signing domain (d=) and the selector (s=).
- The receiving server looks up the public key at selector._domainkey.domain.
- It recomputes the fingerprint and compares it with the signature.
- If they match, DKIM passes: the message came from that domain and nothing signed was changed in transit.
google._domainkey.example.comv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC...google is the selector, v=DKIM1 marks a DKIM key, k=rsa names the key type and p= holds the public key, shortened here.On growthcab.com the selector is google, the default name Google Workspace uses, so the public key lives at google._domainkey.growthcab.com.
Why DKIM matters for deliverability
DKIM gives receivers something SPF cannot: a signature that travels with the message. SPF checks the server that handed over the email, so it often breaks when mail is forwarded. A DKIM signature usually survives forwarding, as long as the signed content is not changed.
DKIM also feeds DMARC. A DMARC check passes when SPF or DKIM passes and the passing domain matches the From address the recipient sees, a match called alignment. If a sending tool signs with its own domain instead of yours, DKIM can pass while DMARC still fails. Google's email sender guidelines require SPF, DKIM and DMARC from anyone sending 5,000 or more messages a day to Gmail.
How to set up DKIM
- In each sending service (Google Workspace, Microsoft 365, your CRM or cold email tool), open the authentication settings and generate a DKIM key for your domain.
- Copy the host name and the TXT or CNAME value the service gives you.
- Publish the record at your DNS provider.
- Go back to the service and turn signing on.
- Send a test email and confirm dkim=pass with your own domain in the message headers.
Repeat these steps for every service that sends as your domain. Each one usually gets its own selector, so keys can be added or retired without touching the others.
A common mistake is publishing the record but never turning signing on, or turning it on in the main mailbox provider and forgetting the CRM and the cold email platform. Check the headers of a real email sent from each tool. A DNS lookup only proves the key exists. A signed message proves it is in use.
Our free cold email domain checker checks DKIM together with MX, SPF and DMARC. For a full audit of signing and alignment across every sending path, see our email deliverability consultant service, and use the cold email deliverability checklist for the wider setup.