How DKIM works
DomainKeys Identified Mail uses a pair of keys. The private key stays on your sending server and creates the signature. The public key sits in a DNS TXT record under a name called a selector, such as selector1._domainkey.yourdomain.com. Receivers fetch the public key and verify the signature.
If the content or key information changed in transit, verification fails. That helps prove a message was not altered after it left.
What you need to do
For most services, enabling DKIM is a two-part job. First, switch it on in the email or sending platform, which generates a key. Second, copy the DNS record it provides into your domain's DNS. Until the record is live, the platform may show DKIM as not authenticated.
Some providers ask for CNAME records instead of TXT, pointing to keys they manage. Follow their instructions exactly, including the full record name.
Each sender needs its own setup
DKIM is set up per sending service. Your mailbox provider, newsletter platform, CRM, invoicing system and store may each sign with their own selector. A domain can hold many selectors at once without conflict.
Check each tool's settings area for a domain authentication or sender verification page. Without it, mail may be sent under the tool's domain or fail alignment checks.
Common problems
Pasting the key with line breaks or missing characters stops verification. Some DNS panels automatically append your domain to the name, creating a doubled name like selector1._domainkey.yourdomain.com.yourdomain.com. Check how your panel treats the host field.
Keys can be rotated. If a provider tells you to update the record after a change, do it, or signing may fail. Very old keys of weak length should be replaced with the size the provider recommends.
Verify it works
Send a message to a personal mailbox and view the original source or headers. Look for dkim=pass and check which domain was signed. A pass with the provider's domain, not yours, means your own domain is not yet aligned for DMARC purposes.
Free online DKIM lookup tools can confirm the record exists for a selector. If you are unsure which selector a service uses, its documentation lists it.
Why DKIM matters for deliverability
Mailbox providers weigh signed mail more favorably, and many bulk sender rules from large providers expect authentication that includes DKIM. Signing also gives your domain a reputation of its own, separate from the shared one that the platform uses for all customers.
If you send newsletters or invoices at volume, taking a few minutes to set up your own signature can be one of the more effective steps for keeping messages out of spam folders.
If a vendor will not let you sign with your own domain on its basic plan, check whether a higher tier unlocks it. For a business that relies on that tool to reach customers, the setting is usually worth the upgrade.
Common questions
Is DKIM the same as encryption?
No. It signs messages to prove origin and integrity but does not hide their content.
Can I have more than one DKIM record?
Yes. Each service uses its own selector, so many can coexist.
Do I need DKIM if I have SPF?
It is advisable. DKIM survives forwarding better, and DMARC can use either one.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.