DKIM explained
DKIM: proof the email really came from you
DKIM signs each message with a private key. Receivers check the signature against a public key you publish in DNS.
Where it lives
A TXT record at selector._domainkey on your domain. Your email provider gives you the selector and the key.
google._domainkey v=DKIM1; k=rsa; p=MIIBIjANBgkqh...What to know
Your provider makes the key
Google Workspace, Microsoft 365 and most hosts generate it in their admin panel. You only publish it.
Use 2048-bit keys
Shorter keys are weaker, and some receivers now distrust them.
One per sending service
Each tool that sends as you gets its own selector, so they never clash.
Common mistakes
- Publishing the key but never turning signing on in the provider
- A key split across lines with spaces left in
- Deleting an old selector a tool still signs with