DKIM Setup

What is this?

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Your mail server signs each email with a private key, and publishes the matching public key as a DNS TXT record. When receiving servers get your email, they look up your public key and verify the signature.

The DNS record looks like this - at selector._domainkey.yourdomain.com:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ...

You don't write this by hand - your email provider generates it and tells you exactly what to add.

Why it matters

DKIM is a key trust signal for inbox placement:

• Gmail uses DKIM to rank email trustworthiness. Emails without DKIM are more likely to be treated as spam, especially from newer domains.
• It's required for DMARC to work properly. DMARC alignment requires either SPF or DKIM to pass. Without DKIM, SPF alone isn't enough if email is forwarded.
• It proves the email wasn't tampered with in transit. SPF only verifies the sending server; DKIM also verifies the message content.

How to fix it

1. Log in to your email sending service (Resend, Postmark, Google Workspace, etc.)
2. Find the DKIM/domain authentication setup page
3. The service will give you one or two TXT records to add to your DNS
4. Add those records exactly as instructed (name like google._domainkey or s1._domainkey)
5. Click "Verify" in the service dashboard - it may take a few minutes for DNS to propagate

Providers & tools