Configuring DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails, proving they came from your domain and haven't been tampered with. This guide covers everything you need to set up DKIM correctly.

What is DKIM?

DKIM works by:

Signing emails - Your mail server adds a digital signature to each outgoing email
Publishing public keys - You publish DKIM public keys in your DNS
Verification - Receiving servers verify signatures using your public keys

Why DKIM Matters

Email Authentication - Required by Google, Yahoo, and Microsoft for bulk senders
Deliverability - Improves inbox placement rates
Security - Prevents email tampering and spoofing
Reputation - Builds domain reputation independent of IP addresses

DKIM Record Structure

DKIM records are published as TXT records at:

{selector}._domainkey.{yourdomain.com}

Key Components

Component	Description	Example
Selector	Identifies which key to use	`default`, `google`, `mailchimp`
Public Key	The cryptographic public key	`p=MIGfMA0GCSqGSIb3...`
Version	DKIM version (usually `v=DKIM1`)	`v=DKIM1`
Key Type	Encryption algorithm	`k=rsa`
Key Length	Minimum 1024-bit (2048-bit recommended)	`h=sha256`

Step-by-Step Setup Guide

Step 1: Choose Your DKIM Selector

Selectors allow you to use multiple DKIM keys for different services:

default - General purpose
google - Google Workspace
mailchimp - Mailchimp campaigns
sendgrid - SendGrid transactional

You can use any name, but descriptive names help with organization.

Step 2: Generate DKIM Keys

Option A: Using Your Email Provider

Most email providers generate keys for you:

Google Workspace:

Admin Console → Apps → Google Workspace → Gmail
Authenticate email → Select domain
Generate new record → Copy public key

Microsoft 365:

Security & Compliance → DKIM
Select domain → Enable DKIM
Copy CNAME records (Microsoft manages keys)

SendGrid/Mailchimp:

Keys generated automatically in domain settings
Copy provided DNS records

Option B: Generate Your Own Keys

For custom implementations, generate RSA keys:

# Generate 2048-bit RSA key pair
openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key

Extract the public key for DNS (remove headers/footers):

# Extract public key content
openssl rsa -in private.key -pubout -outform DER | openssl base64 -A

Step 3: Create DNS TXT Record

Add a TXT record with the following structure:

Record Details:

Field	Value
Type	TXT
Host/Name	`{selector}._domainkey`
Value	`v=DKIM1; k=rsa; p={your-public-key}`
TTL	3600 (1 hour) or default

Example DNS Record:

Host: default._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7vbqajDwY...

Step 4: Configure Your Mail Server

Postfix (Linux)

Edit /etc/postfix/main.cf:

# Enable DKIM signing
milter_protocol = 2
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
 
# DKIM key configuration
dkim_key_file = /etc/postfix/dkim/default.private
dkim_selector = default
dkim_domain = yourdomain.com

Microsoft Exchange

Exchange Admin Center → Protection → DKIM
Select domain → Enable DKIM
Microsoft automatically configures DNS

Google Workspace

Admin Console → Apps → Google Workspace → Gmail
Authenticate email → Select domain
Enable DKIM signing
Add DNS record provided

Step 5: Verify DKIM Setup

Using MailSentinel

Go to your domain in MailSentinel
Click Check DNS
Verify DKIM records are detected
Check key length and validity

Manual Verification

Send a test email and check headers:

# Send test email
echo "Test DKIM" | mail -s "DKIM Test" your-email@example.com
 
# Check headers (look for Authentication-Results)
Received-SPF: pass
Authentication-Results: example.com;
  dkim=pass header.d=yourdomain.com;
  dkim-signature=v=1; a=rsa-sha256; c=relaxed/relaxed;

Online Tools

MXToolbox DKIM Checker - https://mxtoolbox.com/dkim.aspx
DKIM Validator - https://www.dmarcanalyzer.com/dkim-check/
Mail-Tester - https://www.mail-tester.com/

Common DKIM Configurations

Google Workspace

DNS Record:

Host: google._domainkey
Type: TXT
Value: v=DMARC1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Configuration:

Selector: google
Key length: 2048-bit
Algorithm: RSA-SHA256

Microsoft 365

Microsoft uses CNAME records instead of TXT:

Host: selector1._domainkey
Type: CNAME
Value: selector1-yourdomain-com._domainkey.onmicrosoft.com

SendGrid

DNS Record:

Host: s1._domainkey
Type: TXT
Value: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Mailchimp

DNS Record:

Host: k1._domainkey
Type: TXT
Value: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Multiple DKIM Keys (Selectors)

You can use multiple selectors for different services:

default._domainkey.yourdomain.com  → General email
google._domainkey.yourdomain.com   → Google Workspace
mailchimp._domainkey.yourdomain.com → Mailchimp campaigns
sendgrid._domainkey.yourdomain.com → SendGrid transactional

Benefits: