{"id":30015,"date":"2022-09-22T07:43:59","date_gmt":"2022-09-22T07:43:59","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=30015"},"modified":"2025-07-30T12:03:28","modified_gmt":"2025-07-30T12:03:28","slug":"what-is-a-dkim-record","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/what-is-a-dkim-record\/","title":{"rendered":"What is a DKIM Record?"},"content":{"rendered":"

What is a DKIM record<\/b>? That’s a question we see everywhere these days. Emails have become the primary communication between businesses, vendors, and associates. Unfortunately, emails aren\u2019t 100% secure.\u00a0<\/span><\/p>\n

They can be intercepted, spoofed, and modified by malicious online actors. With more companies looking to implement DMARC to protect their email infrastructure, it’s essential to understand the role DKIM plays in this system.<\/span><\/p>\n

DMARC is an authentication standard that verifies your emails and lets your mailing list know every message sent from your domain<\/span> is<\/span><\/i> coming from <\/span>you<\/span><\/i>. This protocol works with SPF and DKIM<\/a>.\u00a0<\/span><\/p>\n

This blog post will show you everything you need to know about DKIM. We’ll study <\/span>what a DKIM TXT record is<\/b>, <\/span>what a DKIM key is,<\/b> and every relevant aspect of this security policy. Take a seat and enjoy this deep dive into DKIM.<\/span><\/p>\n

What is DKIM?<\/b><\/h2>\n

When people ask <\/span>what DKIM is<\/span><\/a>, the briefest way to explain it is by calling it a digital signature. If you want a more technical explanation, you’ll find that DKIM stands for DomainKeys Identified Mail, and a DKIM record is a modified <\/span>TXT record<\/span><\/a> added to your domain’s DNS.\u00a0<\/span><\/p>\n

The TXT record contains a public key used by receiving email servers to verify the digital signature in all your messages and make sure they come from your domain.<\/span><\/p>\n

What are the DKIM Record Components?<\/b><\/h2>\n

When you <\/span>add a DKIM record to your DNS<\/span><\/a>, a series of components works to make sure they do the job of verifying your domain. Most of these elements are informal and represented by using tags.\u00a0<\/span><\/p>\n

How does a DKIM record work?<\/span><\/p>\n

The tags work as commands signalled by a single letter followed by an equal sign, such as “s=.” The value for each tag indicates information about the sender and the public key.<\/span><\/p>\n

The structure of each DKIM record is based on proper syntax. A <\/span>DKIM signature<\/span> only works if it’s properly configured. A few tags are available to the sender; some are mandatory, while others are optional.\u00a0<\/span><\/p>\n

A missing tag leads to verification errors with certain email providers. Tags with no value added to any record are taken as empty, while missing tags are taken out by default.<\/span><\/p>\n

If your email service provider gives you DKIM records with backslashes before semicolons or double quotes around the record, you can remove them.\u00a0<\/span><\/p>\n

These additional characters can mess with the syntax of your DKIM record. Your server’s name usually handles any extra quoting marks. As for any other characters, they’re automatically disregarded.<\/span><\/p>\n

This example is how a working DKIM record should look:<\/span><\/p>\n

v=1; a=rsa-sha286;\u00a0<\/b><\/p>\n

d=example.com; s=big-email;<\/b><\/p>\n

h=from:to:subject;<\/b><\/p>\n

bh=1xGbmmJeqQzJ5QMeHLElPZWTig6aBMwtxzt6Dei3GzO8s=;<\/b><\/p>\n

b=LiIvJeRyqMo0gngiCygwpiKphJjYezb5kXBKCNj8DqRVcCk7obK6OUg4o+EufEbB<\/b><\/p>\n

tRYQfQhgIkx5m70IqA6dP+1yc9n5JU-7bTkT9FxgIYFJutPbxbyfsBXlbD4wJ-Mdt8\/Wk4w<\/b><\/p>\n

ZG4tu\/g+OA49mS7VX+64FXr79MPwOMRRmJ3lNwJU=<\/b><\/p>\n

What is a DKIM Header?<\/b><\/h2>\n

Now that you know <\/span>what a DKIM record is<\/b>, we can discuss how a DKIM header<\/a> works. Every time you generate a message, the sending server creates a digital signature using the header of your message, a hash of the email body, and the private key of your DNS.\u00a0<\/span><\/p>\n

All these elements are combined to create a digital signature for your email, forming part of the DKIM header.<\/span><\/p>\n

This DKIM signature is one of multiple headers attached to your message. ESPs rarely show headers when displaying emails unless receivers have a specific configuration for their inbox.\u00a0<\/span><\/p>\n

Mailbox services such as Gmail let users view email senders just by clicking in the upper right section of any message and choosing the option to see the original message.<\/span><\/p>\n

How to Check If Your DKIM is Valid?<\/b><\/h2>\n

You can always use EasyDMARC’s free <\/span>DKIM lookup<\/span> tool to check if your domain has any\u00a0 DKIM records. Just make sure to input your selector name with your domain. That way, you’ll be able to retrieve your published DKIM records.\u00a0<\/span><\/p>\n

Since domains can have multiple DKIM records for different public keys and senders, you must remember to use other selector names for each.<\/span><\/p>\n

What Happens if DKIM Fails?<\/b><\/h2>\n

Once you create a DKIM record, you’re not exempt from mistakes. DKIM verification can still fail due to several reasons, such as:<\/span><\/p>\n