How to Set Up DKIM Signing and Publish the DNS Key

DKIM adds a cryptographic signature to every message you send, and publishes the matching public key in DNS so receivers can verify the mail truly came from your domain and was not altered. Setting it up means generating a key pair, letting your mail server sign with the private half, and publishing the public half as a DNS TXT record.

How DKIM works

Your mail server holds a private key and signs outgoing messages, adding a DKIM-Signature header. The corresponding public key lives in a DNS TXT record. A receiving server fetches that public key, checks the signature, and confirms the message is authentic and unmodified. It is one leg of SPF, DKIM and DMARC.

The selector

DKIM uses a selector so you can have more than one key. The public key is published at selector._domainkey.yourdomain.com. The DKIM-Signature header names the selector, so the receiver knows exactly which DNS record to look up. Selectors also make key rotation clean — publish a new selector, switch to it, retire the old.

Setting it up

1. Generate a key pair — most mail platforms and control panels do this for you. Prefer a 2048-bit key.
2. Enable signing on your mail server or service so outgoing mail is signed with the private key.
3. Publish the public key as a TXT record at selector._domainkey. On cPanel this is largely automated — see adding SPF, DKIM and DMARC; on Webuzo see SPF and DKIM in Webuzo.

The DNS record contents

The published TXT record identifies the key type and the public key material (a v=DKIM1 record with the key). If your provider generates it, publish exactly what they give you — a single altered character breaks verification.

Verify it works

Check the record with dig TXT against selector._domainkey.yourdomain.com, and send a test message to confirm receivers see a DKIM pass. Once DKIM passes, layer DMARC on top.

Frequently asked questions

What is a DKIM selector?

A label that lets you run multiple DKIM keys. The public key is published at selector._domainkey.yourdomain.com, and each signed message names its selector so receivers fetch the right key. It also makes rotating keys straightforward.

Should I use a 1024 or 2048-bit key?

Use 2048-bit where supported — it is stronger and now the expected standard. Some very old setups only allowed 1024, but modern DNS and mail handle 2048 fine.

My DKIM is failing — what should I check?

Confirm the published TXT record matches your key exactly, that the record is at the correct selector._domainkey name, and that your server is actually signing. A copy-paste error or a wrong selector is the usual cause.