DKIM setup: how to turn it on and check that it works

Your sending service signs each message with a private key. The matching public key sits in DNS under a name called a selector. Receivers fetch the key, check the signature, and know the message is yours and unchanged.

Gmail, Yahoo and Microsoft require DKIM from bulk senders, and DMARC needs SPF or DKIM to pass for your own domain. DKIM is the one that survives forwarding, so it matters most.

1. List every service that sends mail as your domain: your mail host, newsletter tool, webshop, invoicing and helpdesk software.
2. In each one, open the domain or DKIM settings and choose to sign with your own domain. The service generates a key and shows a DNS record.
3. Add that record at your DNS provider exactly as shown. Some services give a CNAME pointing to their own key; that is fine and makes key rotation their job.
4. Go back to the service and press verify, or wait for it to find the record.

fyz2026._domainkey.example.com.  TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
s1._domainkey.example.com.       CNAME  s1.domainkey.u123.newsletter-tool.net.

Checks need the selector to find the key. Send yourself a mail, open its headers and find the DKIM-Signature line: s= is the selector and d= is the signing domain.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=fyz2026; ...

The d= value should be your own domain. If it shows the service's domain instead, the service signs for itself and DMARC will not count it for you.

• A long key split wrongly: a 2048-bit key is longer than 255 characters, so some DNS panels need it in quoted chunks. Paste it the way your provider's help page says.
• The domain added twice: typing fyz2026._domainkey.example.com into a panel that appends example.com creates fyz2026._domainkey.example.com.example.com.
• Signing turned on at the mail host but not in the newsletter tool, so only part of your mail is signed.
• Old 1024-bit keys. They still work, but use 2048 bits for any new key.

Send a mail to a Gmail or Outlook address, open the original and look for dkim=pass with header.d= set to your domain. Or run the mail check, which looks up DKIM keys under the common selectors and shows what it found.