DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email. Receiving servers check it against a public key in your DNS to confirm the message came from your domain and wasn't altered.
DKIM adds a hidden digital signature to every email your business sends. Receiving providers use a public key published in your DNS to check the signature, which confirms the message really came from your domain and wasn't changed along the way. You turn it on inside your email provider, then add one DNS record.
DKIM is like a wax seal on a letter. Anyone can see it, only you can make it, and if someone tampers with the contents the seal no longer matches.
How does DKIM work?
DKIM uses a pair of keys. Your email provider keeps a private key and uses it to sign every outgoing message. The matching public key is published in your DNS as a TXT record, at a name made of a selector plus ._domainkey, such as google._domainkey.
When your email arrives, the receiving provider reads the signature, looks up your public key, and checks that they match. If the message was forged or altered on the way, the check fails.
Why does DKIM matter for small businesses?
DKIM gives providers strong proof that your email came from you, which helps your invoices and quotes reach the inbox. It's also one of the two checks DMARC relies on.
DKIM is especially useful because the signature travels with the message. When email is forwarded, SPF often fails because a different server is now sending it. A valid DKIM signature can still pass.
How do I check or set up DKIM?
DKIM is switched on inside your email provider, which then gives you a DNS record to add.
- For Google Workspace, open the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email, generate a record, add it at your DNS host, then click Start authentication.
- For Microsoft 365, open the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, and enable signing for your domain.
To check it's working, send an email to a Gmail address, open it, and choose Show original. Look for dkim=pass in the results. A free CyberVigil scan also looks for DKIM keys on common selector names, and the DMARC checker shows whether DMARC is ready to use them.
DKIM vs SPF
SPF says which servers may send for you. DKIM proves a specific message is yours and unchanged. Neither looks at the "From" address people see, which is why you add DMARC on top. Our guide to SPF, DKIM and DMARC shows how they fit together.
Common questions
What is a DKIM selector?
A selector is the label that tells receivers where to find your public key in DNS, published at a name like google._domainkey.yourbusiness.com. Each email service picks its own selector, which is why one domain can have several DKIM keys.
Why does a scan say DKIM wasn't found when I set it up?
Outside scanners can only test common selector names, because selectors aren't published in a central list. If your provider uses an unusual selector, check the DKIM status inside your email admin console instead.
How long does DKIM take to start working?
Google says it can take up to 48 hours after you add the DNS record. Once the record is live, click Start authentication in the Google Admin console, or enable signing in Microsoft Defender.
Sources
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (IETF / RFC Editor)
- Set up DKIM (Google Workspace Help)
- Set up DKIM to sign mail from your Microsoft 365 domain (Microsoft Learn)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.