Glossary / DKIM

DKIM: the digital signature on your mail

DKIM (DomainKeys Identified Mail) is a digital signature your mail server adds to every outgoing message. It proves the email really came from your domain and that the content was not changed along the way. The receiving server verifies the signature using a public key published in your domain's DNS.

It runs on a key pair. A private key stays on your mail server and signs each message, while the matching public key is published in DNS as a TXT record at selector._domainkey.yourdomain. The recipient fetches that key and checks whether the signature matches.

If it matches, the message is treated as genuine and untouched, which raises trust and the odds of reaching the inbox. If someone altered the headers or body in transit, the signature no longer lines up.

DKIM is set up wherever your mail is sent from. On cPanel it is usually enabled automatically, while external services (newsletters, a CRM, Google Workspace) give you their own selector to add to DNS.

Example

google._domainkey TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."

Common mistakes

• Copying the p= key only partway, so the signature can never verify.
• Forgetting a separate DKIM record for each sending service, not just your main mail.
• Thinking DKIM encrypts the email; it signs it, it does not hide the content.
• Rotating the key on the server but not updating the selector in DNS.

Related terms

• SPF SPF record: what it is and how it works
• DMARC DMARC: the rule for mail that fails checks