DKIM record
A DKIM (DomainKeys Identified Mail) record publishes a public key. Your email provider signs every message with the matching private key, and receivers use the key in DNS to check the signature, proving the message really came from your domain and wasn't changed on the way.
| Record type | TXT (DKIM is a standard carried in TXT records) |
|---|---|
| Lives at | <selector>._domainkey |
| Used for | |
| How common | Everyday |
| Defined in | RFC 6376, RFC 8463 |
Format
<selector>._domainkey <ttl> IN TXT "v=DKIM1; k=rsa; p=<public key>"
| Field | What it means | Accepted values |
|---|---|---|
| Selector | A label that picks which key to use, so you can have several (one per provider, or old and new). It's in each message's DKIM-Signature header as s=. | Chosen by your provider, such as google, selector1, s1, k1. |
| v=DKIM1 | Marks the record as a DKIM key. Optional, but first if present. | DKIM1 |
| k= | Key type. | rsa (default) or ed25519. |
| p= | The public key, base64. Empty means the key was revoked. | About 216 characters for 1024-bit RSA, 392 for 2048-bit. |
| t= | Flags: y for testing, s for strict domain matching. | y, s, or y:s. |
| h=, s=, n= | Allowed hashes, service type, and a human note. Rarely needed. | h=sha256, s=email. |
Check a DKIM record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid TXT record (DKIM public key).
| Part | What it means |
|---|---|
| Namegoogle._domainkey | A name under the domain. In a dashboard for example.com, “google._domainkey” means google._domainkey.example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeTXT | Free text: SPF, DKIM, DMARC, verification. |
| String 1v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA31BsCQ3zDZKCA54Dyn4PdR+0z… | 255 bytes. Joined with the other strings, with nothing in between, when read. |
| String 2Xd1HQA9wX4t6M4m1rhHtKjcY6/fYpZTNQMBp/KL3y/0jtnuo6kopUIZau1VWbYhiF3DTgYHASzSLbJY9L9WgmLH… | 155 bytes. Joined with the other strings, with nothing in between, when read. |
| vv=DKIM1 | Marks this as a DKIM key. Optional, but if present must be DKIM1 and first. |
| kk=rsa | RSA key (the default). |
| pp=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA31BsCQ3zDZKCA54Dyn4PdR+0z5RAcW8… | The public key, about 2048-bit RSA. |
To check the DKIM record a domain publishes right now, use the DKIM checker.
Examples
Google Workspace
google._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
Generate the key in the Google Admin console, then publish it here.
Microsoft 365 uses CNAMEs
selector1._domainkey 3600 IN CNAME selector1-example-com._domainkey.example.onmicrosoft.com.
Some providers host the key themselves and ask for a CNAME, so they can rotate it without you.
A revoked key
old._domainkey 3600 IN TXT "v=DKIM1; p="
An empty p= tells receivers any signature with this selector is invalid.
Finding your selector
Your provider tells you the selector when you set DKIM up. To find it from an email you sent, open the original message (Show original in Gmail) and look at the DKIM-Signature header: s= is the selector and d= is the signing domain. The record lives at s._domainkey.d.
There's no way to list every selector a domain uses from DNS alone; you have to know the name.
Look up DKIM records
TTL
3600. When rotating keys, publish the new selector days before switching, and keep the old one until mail signed with it has been delivered. How TTL works
Common mistakes
- Publishing at _domainkey or at @ instead of selector._domainkey.
- Line breaks or spaces pasted into the middle of the key.
- A key longer than 255 characters at a DNS host that doesn't split strings, so it's cut off.
- Turning DKIM on in the provider before the record is published, so mail fails checks for a while.
- Using a 1024-bit key. It still works, but 2048-bit is the recommendation.
At your DNS host
- Cloudflare and most registrars split a long key for you; paste it as one line.
- Route 53: split a 2048-bit key into two quoted strings on one line.
- Some dashboards add the domain to the name: enter google._domainkey, not google._domainkey.example.com.
Questions
What is a DKIM selector?
The first part of the record's name (selector._domainkey.example.com). It lets one domain have several keys, one per sending service. Each signed email says which selector to look up.
Can I have several DKIM records?
Yes, one per selector. Each sending service gets its own selector and key.
Should I use 1024 or 2048-bit keys?
2048-bit. 1024-bit keys still validate, but are considered weak.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free