Email DNS explained
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Receivers check it against a public key in your DNS to confirm the message really came from your domain and wasn’t changed on the way.
How DKIM works
Your email provider signs each outgoing message with a private key it keeps. You publish the matching public key in DNS. A receiving server reads the signature, fetches your public key and checks that they match.
Without a working DKIM signature, receivers can’t confirm your mail really came from you, so it is more likely to land in spam.
Source: RFC 6376: DKIM (IETF), Email sender guidelines (Gmail Help)
What a selector is
The public key lives at a name like selector._domainkey.yourdomain.com. The selector is a label chosen by your provider or by you, which lets a domain publish more than one key. Google uses google by default, Microsoft 365 uses selector1 and selector2, and in Zoho Mail you choose it yourself.
Source: RFC 6376: DKIM (IETF), Set up DKIM (Google Workspace Help), How to use DKIM for email in your custom domain (Microsoft Learn), DKIM Configuration (Zoho Mail Help)
TXT or CNAME
Some providers ask you to publish the key itself in a TXT record (Google Workspace, Zoho Mail). Others give you CNAME records that point to keys they host and rotate (Microsoft 365).
Source: Set up DKIM (Google Workspace Help), DKIM Configuration (Zoho Mail Help), How to use DKIM for email in your custom domain (Microsoft Learn)
Common DKIM mistakes
What goes wrong most often:
- Publishing the record but never turning DKIM on in the provider’s admin console.
- Copying the key with missing or extra characters.
- Adding a DKIM CNAME on Cloudflare with the proxy (orange cloud) turned on.
Source: Set up DKIM (Google Workspace Help), How to use DKIM for email in your custom domain (Microsoft Learn), DKIM Configuration (Zoho Mail Help), Proxy status (Cloudflare DNS Docs)
DKIM for your email provider
The exact values and steps for each provider:
DKIM: questions
How do I find my DKIM record?
It lives at selector._domainkey.yourdomain.com. Your email provider’s admin console shows the selector and the value: google for Google Workspace, selector1 and selector2 for Microsoft 365, and the selector you chose in Zoho Mail. Our checker looks it up for you.
Can I copy a DKIM key from another guide?
No. The key is generated for your domain in your provider’s admin console. A key from anywhere else won’t match the signatures on your mail.
Is DKIM required?
Gmail asks every sender for SPF or DKIM, and DMARC needs at least one of them to line up with your domain. Setting up both is the safest choice.
Ready to set it up?
Pick your email provider and DNS host to get the exact records and steps.