In short
- The selector name must match exactly what your provider signs with.
- Publish the public key as a TXT record — watch for split-string quoting.
- Use 2048-bit keys where supported.
- Verify a real signed message, not just the DNS record.
Steps
- Enable DKIM in your SMTP or sending provider's settings.
- Copy the selector name and the public key value it generates.
- Create a TXT record at selector._domainkey.yourdomain.com with that value.
- Wait for propagation, then look up the selector to confirm the key resolves.
- Send a test message and confirm the DKIM signature passes and the signing domain matches your From domain.
Record anatomy
Host / name
bulk2026._domainkey.yourdomain.comValue
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... (your public key)Common DKIM problems
- Wrong selector — the DNS record exists but not at the name your provider signs with.
- Truncated key — long TXT values get cut by some DNS editors; check the full string resolves.
- Quoting issues when a DNS provider splits long strings.
- Signing domain not aligned with the visible From domain, so DMARC still fails.
- Rotating keys at the provider without publishing the new selector.
Key rotation
Rotate DKIM keys periodically by publishing a new selector, switching signing to it, and only then removing the old record. Never remove the old selector while mail signed with it may still be in transit.
Checklist
- DKIM signing enabled at the sender.
- Public key published at the exact selector.
- Full key value resolves without truncation.
- Signature verified on a real test message.
- Signing domain aligns with the From domain.
Run these checks now
Questions people ask
Can I have several DKIM selectors?
Yes, and you usually should — one per sending service, plus a new one during key rotation.
1024-bit or 2048-bit keys?
Use 2048-bit where your provider and DNS host support it. 1024-bit still validates but is weaker.
Does DKIM survive forwarding?
Usually yes, as long as the message body and signed headers are not modified — which is why DKIM is more forwarding-resilient than SPF.