What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message. The receiver looks up your public key in DNS and verifies the signature. A valid signature proves the message came from a system holding your private key and was not changed in transit.

How it works

Your mail system signs selected headers and the body with a private key.
It adds a DKIM-Signature header that names the signing domain (d=) and a selector (s=).
The receiver fetches the public key from <selector>._domainkey.<d=domain> and verifies the signature.

Selectors

A selector is a label that lets one domain publish several keys, for example one per mail service. The selector is set by whoever signs the mail, so you must ask each sender what selector it uses.

Term	Example
Selector	`s1`
DNS name	`s1._domainkey.example.com`
Signing domain (`d=`)	`example.com`

Note: DMARC+ looks up your DKIM record only for the selector you provide. When you add a domain, enter the selector of your main mail system. To check another selector, use the DKIM tool. See Lookup tools.

DKIM and DMARC alignment

For DMARC, the d= domain must align with the From domain. A signature from a sender's own domain (for example d=esp.example.net) can be valid but does not help your DMARC. Ask the service to sign with your domain, which normally means adding DNS records they give you.

Key size

Use 2048-bit keys where your DNS host and mail system support them. Some DNS hosts need a long TXT value split into several quoted strings. The DMARC+ DKIM generator offers 1024 and 2048 bit sizes.

Rotating keys

Publish the new selector first, switch the signer to it, and only later remove the old record. Removing the old key too early makes messages in transit fail.

Checking DKIM

Open DMARC+ > Tools > DKIM.
Choose the domain and enter the selector.
Read the Summary and the DKIM Record tabs.

Tip: if the tool says "not found", first check the selector spelling. A correct record under a different selector will look missing.