DFY GTM Systems

DKIM Guide

By Abdul Sami, GTM Engineer · 6 min read · Last updated

DKIM (DomainKeys Identified Mail) cryptographically signs outgoing email so receivers can verify it came from your domain and wasn't altered. Setup: your sending platform generates a key pair, you publish the public key as a TXT record at selector._domainkey.yourdomain, then enable signing in the platform.

How the pieces fit

The platform signs each message with a private key. Receivers fetch the public key from DNS using the selector in the DKIM-Signature header (the s= tag) and verify the signature. The DNS record alone does nothing until signing is switched on.

Selectors

A selector labels which key to use 'google' for Google Workspace, 'selector1'/'selector2' for Microsoft 365, custom ones for ESPs. One domain can publish many selectors, one per sending service, enabling key rotation without downtime.

Key length

2048-bit RSA is the current standard. 1024-bit still verifies but is being phased out rotate where your platform supports it. Some DNS providers split long keys into chunks; that's normal.

Verifying it works

Send yourself an email and inspect headers for 'dkim=pass', or run the DKIM Checker against your domain and selector. Test after every platform change migrations silently disable signing.

FAQ

What is a DKIM selector?
The label that locates your public key in DNS (selector._domainkey.domain). Find yours in your ESP's settings or the s= value in a received email's DKIM-Signature header.
My DKIM record is published but mail shows dkim=fail why?
Usually signing isn't enabled in the sending platform, or the platform signs with a different selector than the one you published. Check both sides.
Do I need DKIM for every sending tool?
Yes every platform that sends as your domain (mailbox provider, sequencer, transactional ESP, helpdesk) needs its own DKIM selector published and enabled.
AS

Abdul Sami

GTM Engineer, DFY GTM Systems

7+ years building outbound systems for B2B companies across the US, UK, Australia, and DACH. Specializes in Clay workflows, cold email infrastructure, intent-based lead sourcing, and deliverability.

Rather have it built for you?

One team builds and runs the whole system in your accounts. Live in 10 days.

Book a strategy call