Glossary
The signature that proves your email is genuine — and the one record most domains forget to turn on.
In short
DKIM (DomainKeys Identified Mail) adds a digital signature to each email your server sends. The matching public key is published in DNS under a selector, such as google._domainkey.yourdomain.com. Receivers use it to confirm the message really came from your domain and was not altered in transit.
Your mail server signs selected headers and the body of each message with a private key and adds a DKIM-Signature header. The receiver looks up the public key at selector._domainkey.yourdomain.com and checks the signature. If anything in the signed parts changed, the check fails.
Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email, generate a key, publish the TXT record, then start authentication. Microsoft 365: publish the two CNAME records (selector1 and selector2) shown in the Defender portal, then enable DKIM. Other hosts such as Zoho or Hostinger show their selector and record in the mail settings.
Use 2048-bit keys where your provider allows it, rotate keys periodically, and make sure every tool that sends as your domain signs with DKIM. DKIM survives forwarding better than SPF, which makes it the key signal for DMARC alignment.
Questions
A name that tells receivers where to find the public key, so one domain can have several keys. Google uses google by default; Microsoft 365 uses selector1 and selector2.
Checkers look up common selectors. If your provider uses a custom selector, the key exists but a generic check cannot find it.
More from Infiara
Infiara Where Intelligence Meets Reach.
Connect a mailbox. Import a list. Write once. Launch. Let the inbox turn replies into work.
Infiara AI
Online · Fully AI email automation
