# DKIM record

A DKIM (DomainKeys Identified Mail) record publishes a public key. Your email provider signs every message with the matching private key, and receivers use the key in DNS to check the signature, proving the message really came from your domain and wasn't changed on the way.

- Record type: TXT (DKIM is carried in TXT records)
- Lives at: <selector>._domainkey
- Used for: Email
- How common: Everyday
- Defined in: RFC 6376, RFC 8463

## Format

```
<selector>._domainkey <ttl> IN TXT "v=DKIM1; k=rsa; p=<public key>"
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Selector | A label that picks which key to use, so you can have several (one per provider, or old and new). It's in each message's DKIM-Signature header as s=. | Chosen by your provider, such as `google`, `selector1`, `s1`, `k1`. |
| v=DKIM1 | Marks the record as a DKIM key. Optional, but first if present. | `DKIM1` |
| k= | Key type. | `rsa` (default) or `ed25519`. |
| p= | The public key, base64. Empty means the key was revoked. | About 216 characters for 1024-bit RSA, 392 for 2048-bit. |
| t= | Flags: y for testing, s for strict domain matching. | `y`, `s`, or `y:s`. |
| h=, s=, n= | Allowed hashes, service type, and a human note. Rarely needed. | `h=sha256`, `s=email`. |

## Examples

### Google Workspace

```
google._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
```

Generate the key in the Google Admin console, then publish it here.

### Microsoft 365 uses CNAMEs

```
selector1._domainkey 3600 IN CNAME selector1-example-com._domainkey.example.onmicrosoft.com.
```

Some providers host the key themselves and ask for a CNAME, so they can rotate it without you.

### A revoked key

```
old._domainkey 3600 IN TXT "v=DKIM1; p="
```

An empty p= tells receivers any signature with this selector is invalid.

## Finding your selector

Your provider tells you the selector when you set DKIM up. To find it from an email you sent, open the original message (Show original in Gmail) and look at the DKIM-Signature header: s= is the selector and d= is the signing domain. The record lives at s._domainkey.d.

There's no way to list every selector a domain uses from DNS alone; you have to know the name.

## TTL

3600. When rotating keys, publish the new selector days before switching, and keep the old one until mail signed with it has been delivered.

## Common mistakes

- Publishing at _domainkey or at @ instead of selector._domainkey.
- Line breaks or spaces pasted into the middle of the key.
- A key longer than 255 characters at a DNS host that doesn't split strings, so it's cut off.
- Turning DKIM on in the provider before the record is published, so mail fails checks for a while.
- Using a 1024-bit key. It still works, but 2048-bit is the recommendation.

## At your DNS host

- Cloudflare and most registrars split a long key for you; paste it as one line.
- Route 53: split a 2048-bit key into two quoted strings on one line.
- Some dashboards add the domain to the name: enter google._domainkey, not google._domainkey.example.com.

## Questions

### What is a DKIM selector?

The first part of the record's name (selector._domainkey.example.com). It lets one domain have several keys, one per sending service. Each signed email says which selector to look up.

### Can I have several DKIM records?

Yes, one per selector. Each sending service gets its own selector and key.

### Should I use 1024 or 2048-bit keys?

2048-bit. 1024-bit keys still validate, but are considered weak.

## Related

- [DMARC record](https://lemon.domains/dns-records/dmarc.md)
- [SPF record](https://lemon.domains/dns-records/spf.md)
- [TXT record](https://lemon.domains/dns-records/txt.md)
- [BIMI record](https://lemon.domains/dns-records/bimi.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/dkim