What Is a DKIM Record?

Last updated October 27, 2026

Table of Contents

• What is a DKIM record?
• How DKIM works: digital signatures for email
• Key benefits of DKIM
• Setting up and verifying DKIM
• Technical details
• Have more questions?

What is a DKIM record?

DKIM, which stands for DomainKeys Identified Mail, is an email authentication method designed to enhance the trustworthiness and security of email communications. It provides a way for email recipients to verify that an email message was sent and authorized by the owner of the domain it claims to be from and has not been tampered with in transit.

With email spoofing, phishing, and spam so common, DKIM plays a vital role in helping mail servers differentiate legitimate email from fraudulent messages, significantly reducing the amount of unwanted or malicious email that reaches inboxes.

How DKIM works: digital signatures for email

DKIM utilizes a cryptographic technique involving a pair of keys: a private key and a public key.

1. Signing the email (private key): When an organization sends an email on your behalf (e.g., an email service provider), they use a private key to generate a unique digital signature for that email. This signature is added to the email’s headers.

2. Publishing the public key (DNS TXT record): Your organization publishes the corresponding public key in your domain’s DNS as a TXT record. This public key is placed at a name built from a selector (for example, s1._domainkey.yourdomain.com or google._domainkey.yourdomain.com). The selector allows a single domain to have multiple DKIM keys, which is useful for different sending services or key rotation.

3. Verifying the email (public key): When a recipient’s mail server receives an email claiming to be from your domain, it performs a DNS lookup for the DKIM public key using the selector found in the email’s header. It then uses this retrieved public key to verify the email’s digital signature.

If the signature matches, it confirms:

• The email was signed with the private key that matches the public key published in the signing domain’s DNS.
• The signed parts of the email (the body and the signed headers) have not been altered since it was signed.

Key benefits of DKIM

Combats spoofing and phishing: Makes it significantly harder for malicious actors to impersonate your domain.

Improves deliverability: Email servers are more likely to trust and deliver messages that pass DKIM authentication, leading to fewer emails being marked as spam or rejected.

Enhances reputation: Helps build and maintain a positive sending reputation for your domain.

DKIM is one of three protocols that make up email authentication. It works alongside SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance).

Setting up and verifying DKIM

For step-by-step instructions on how to add a DKIM record to your DNSimple zone, including details on formatting and specific fields, please refer to our dedicated How-To Guide: Set Up DKIM. DKIM records are TXT records, which DNS hosting at DNSimple publishes like any other record.

To verify that your DKIM record is correctly published and functioning, consult our How-To Guide: Verify DKIM with dig and Online Tools, which covers using command-line tools like dig and online verification services.

Technical details

The DKIM specification is RFC 6376.

Have more questions?

If you have additional questions or need any assistance with your DKIM records, just contact support, and we will be happy to help. You can also read more about email forwarding at DNSimple.