What DKIM does
When your email provider sends a message, it adds a digital signature to the headers using a private key only it holds. The matching public key sits in your DNS. The receiving inbox fetches that public key and checks the signature.
If it matches, the inbox knows two things: the email was authorised by your domain, and nobody changed it in transit.
What a DKIM record looks like
DKIM records live on a special name: a selector, then ._domainkey, then your domain. Some providers give you a TXT record with the key; others give you CNAME records that point to keys they manage and rotate for you.
preping._domainkey.acme.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"Selectors, and why you can have several
The selector (the part before ._domainkey) lets one domain have many DKIM keys: one per service that sends for you. Your newsletter tool, your helpdesk and your app can each sign with their own key without clashing.
Common DKIM problems
- The key was cut short when pasted. TXT values are long; always use the copy button rather than selecting text.
- The name was doubled. Many DNS panels add your domain automatically, so pasting the full name turns it into selector._domainkey.acme.com.acme.com.
- Proxying is on. In Cloudflare, DKIM CNAME records must be "DNS only" (grey cloud).
- The record was added at the wrong domain, such as www.acme.com instead of acme.com.
How to check yours
DKIM can only be looked up if you know the selector. The free email setup checker tries the common ones and any selector you type, and shows whether a valid key is published.
Questions
Do I need DKIM if I have SPF?+
Yes. DKIM survives forwarding where SPF often breaks, and DMARC needs at least one of them to pass and match your From domain.
Does DKIM encrypt my email?+
No. It signs the email so changes can be detected, but the content isn't hidden.