TechnicalReviewed by Deliverability Engineering4 min read

DKIM

DomainKeys Identified Mail (RFC 6376)

Definition:DKIM is an email authentication protocol that attaches a cryptographic digital signature to outgoing emails, proving to receiving servers that the message originated from your domain and was not altered in transit.

Free Tool: Generate your DKIM record in 10 seconds
Validate and build compliant DNS records instantly without technical knowledge.
Try Tool →
Deliverability Impact
Critical
Implementation Time
5 mins
Pro Tip from the Trenches

Always choose 2048-bit RSA keys over legacy 1024-bit keys. Modern enterprise mail filters (like Proofpoint and Barracuda) score 1024-bit keys as weak cryptography and may penalize deliverability.

DKIM DNS TXT Record
google._domainkey.yourdomain.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Q..."

Frequently Asked Questions about DKIM

Yes! Unlike SPF (which allows only one record per domain), you can have multiple DKIM records using different selectors (e.g. google._domainkey, s1._domainkey).

Detailed Technical Breakdown

DKIM uses public-key cryptography. When an email is sent, the mail server creates a digital signature in the email header using a private key.

The receiving server fetches the corresponding public key from the sender's DNS TXT records to verify the signature. If the signature matches, it confirms integrity and sender authenticity.

The DKIM header contains the selector tag (`s=`), the signing domain (`d=`), the canonicalization algorithm (`c=`), and the cryptographic signature data (`b=` and `bh=`).

Why it matters for Cold Email & Deliverability

Google and Yahoo mandate DKIM for bulk senders. Missing or broken DKIM keys results in immediate spam folder placement or hard rejection.

DKIM prevents man-in-the-middle tampering and protects your brand from email spoofing.

How to optimize DKIM

  1. Generate a 2048-bit DKIM key in your email provider console and add the TXT record to your DNS.
  2. Verify the DKIM key is properly signed using online DNS lookup tools.
  3. Ensure the DKIM signing domain (`d=`) aligns with the From: header domain for DMARC pass status.
  4. Rotate DKIM cryptographic keys every 6 to 12 months for enterprise security compliance.

Common DKIM Mistakes

  • Creating DNS records but failing to activate signing in the email workspace admin panel.
  • Copying trailing spaces into DNS TXT records.
  • Using obsolete 1024-bit RSA keys that modern security gateways classify as weak encryption.