DKIM: the signature under your mail

Module 4: Records for email · Reading time: 8 minutes

Learning objective: After this lesson, you can explain how DKIM works, find and check a DKIM record, and correctly set up a DKIM record from an external service (as TXT or as CNAME).

Key concepts: DKIM, digital signature, private key and public key, selector, _domainkey, d= and s=, v=DKIM1; k=rsa; p=, DKIM via CNAME, key rotation

A seal on every mail

SPF (lesson 4.3) looks at which server a mail comes from. DKIM (DomainKeys Identified Mail, RFC 6376) works differently: it puts a digital signature on the mail itself.

Here's how it works:

1. The sending mail server has a secret private key. It uses this to create a signature for each mail over the most important parts: the sender, the subject, the date and the content.
2. That signature travels along in a header field of the mail: DKIM-Signature.
3. The matching public key sits in the domain's DNS, in a TXT record.
4. The recipient retrieves that public key and checks the signature. If it matches, they know two things: the mail was genuinely signed by someone who manages the DNS of that domain, and the mail wasn't changed in transit.

The nice thing is that DKIM keeps working when a mail is forwarded, as long as the content isn't altered. SPF struggles with that.

Where's the key? The selector

A domain can have several DKIM keys: one from your own mail server, one from Microsoft 365, one from your newsletter service. To tell them apart, each key has a name, the selector.

The signature contains two important fields:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail2026; ...

• d=example.com: the domain that signs.
• s=mail2026: the selector.

The recipient then looks up the key under this name:

<selector>._domainkey.<domain>
mail2026._domainkey.example.com

The _domainkey part is fixed. The record looks something like this:

mail2026._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."

An RSA key of 2048 bits is the usual choice; 1024 bits is the minimum (RFC 8301). Such a key is longer than 255 characters, so the record consists of several text pieces (lesson 4.2). Most panels handle that themselves.

Your own DKIM, and that of services

Your hosting package or mail server. On many servers, DKIM is on by default and the panel sets the record in the DNS itself. You'll then see a TXT record with a name like x._domainkey or default._domainkey.

If your domain's DNS is hosted elsewhere (for example at Cloudflare or your registrar), your mail server can't set the record there itself. In that case, copy the name and full value from your hosting panel and create a TXT record with exactly that name and value at your DNS provider. People often forget this when switching nameservers: mail then suddenly goes to spam more often.

External services. Microsoft 365, Google Workspace and newsletter services sign with their own key. They'll give you one or more records:

• As TXT, for example Google Workspace: name google._domainkey, value v=DKIM1; k=rsa; p= followed by the long key.
• As CNAME, for example Microsoft 365 (selector1._domainkey and selector2._domainkey) or Mailchimp (k2._domainkey and k3._domainkey). A CNAME points to a key that the service manages itself. Advantage: the service can replace its key without you having to do anything.

All these records have their own selector, so they don't get in each other's way. Don't remove the DKIM record of your own mail server when you add a service.

Why two selectors?

Services like Microsoft 365 ask for two CNAME records, selector1 and selector2. They sign with one key at a time and switch to the other at set times (key rotation). If you only set selector1, it will work until the first switch, and then DKIM fails all at once. So always set all the records the service specifies.

Common mistakes

• Duplicate domain name. You type k2._domainkey.example.com in a panel that appends the domain name itself. Result: k2._domainkey.example.com.example.com. Type just k2._domainkey.
• TXT instead of CNAME (or the other way round). Use exactly the type the service specifies.
• No trailing dot on a CNAME target. In panels that require it: dkim2.mcsv.net. with a dot.
• Key cut off. The last part of p= gets lost when copying. Compare the start and end with the original.
• DKIM enabled in the service's panel, but records not set, or the other way round. With most services, you need to set the records first and then enable DKIM in their management screen.

Checking whether DKIM works

Send a mail to an address at a large provider (for example Gmail) and view the original (Show original or View source). Look for dkim=pass and check which domain is listed next to it. Or send a mail to a testing service such as mail-tester.com. You can also query the record yourself with a DNS tool: look up the TXT record of <selector>._domainkey.<domain>.

In practice: what it looks like in a panel

In this example, we use DirectAdmin. In DNS Administration, there's a TXT record with the name x._domainkey; the value starts with v=DKIM1; k=rsa; p=. Under E-mail Manager, E-mail Accounts, there's a button to turn DKIM on or off. You create a CNAME from a service via Add Record, type CNAME, name k2._domainkey, value with a trailing dot.

In other panels, DKIM sometimes appears under "Email authentication" or "Email security", but the record in the DNS is the same everywhere.

Summary

• DKIM puts a digital signature on every mail; the public key sits in the DNS.
• The key sits at <selector>._domainkey.<domain>. The selector appears in the signature (s=), as does the domain (d=).
• Each service has its own selector; records from different services sit alongside each other.
• Services often use CNAME records and multiple selectors. Set them all, with exactly the specified type.
• If your DNS is hosted elsewhere, you need to set the DKIM key of your own mail server there yourself.

Quiz

Exercise

Exercise Z4.4: Looking up DKIM. Open a mail you've received from a company or organisation and view the original. In the DKIM-Signature header, find the domain (d=) and the selector (s=). Enter both. The check will look up the matching key.

Exercise O4.4: Setting it up yourself in your practice zone. In the practice zone, you use a fake service; for your real domain, you'll use the actual key or CNAME from your mail server or service. You'll receive a practice key for this exercise (the value after p=). That key is long: paste it in full, without leaving anything out. In your practice zone <code>.dnspractice.eu, create:

1. a TXT record at cursus._domainkey with the value v=DKIM1; k=rsa; p=<practice key>;
2. a CNAME record at k2._domainkey pointing to dkim.newsletter-demo.dnspractice.eu. (with the trailing dot if your panel requires it).

Further reading

The steps in these articles apply to WebOké's panels; in other panels, it works similarly.

• DirectAdmin guide 5.8: Turning on and checking DKIM
• Setting up DKIM when DNS is hosted on an external server
• DirectAdmin guide 5.4: CNAME records and the trailing dot
• WebOké manual 6.7: The Set up email card (MX, SPF, DKIM, DMARC)
• RFC 6376 (DKIM), RFC 8301 (key length), RFC 8463 (Ed25519)