What is a DKIM selector?

A label that lets a domain publish more than one DKIM key. The record is published at selector._domainkey.yourdomain.com.

Should I generate my own DKIM key?

Only if you run your own mail server. Most email services create the key and give you the record to publish.

Why is my DKIM record split into parts?

DNS limits each text string to 255 characters, so a long 2048-bit record is split into several quoted strings.

How do I know DKIM is working?

Send a test message to a mailbox you control and check the headers for dkim=pass.

Does each email address need its own DKIM key?

No. Keys belong to a domain and selector, so all addresses on a domain can share one key.

How do I check my DKIM record?

Use the DKIM Validator with your domain and selector. It reports the key size and any problems with the record.

How to Set Up DKIM for Your Domain

Step-by-step

Check your email provider first. Services such as Google Workspace and Microsoft 365 create the DKIM key for you and give you the DNS record to publish.
In the DKIM Generator, choose your sending platform to see whether it creates the key, and add the email addresses you send from so the tool can work out which domains need a key.
If you run your own mail server, enter your domain and a selector, such as default or a year-based name, and choose a 2048-bit key unless your DNS host cannot store long records.
Generate the key pair, then add a TXT record at selector._domainkey.yourdomain.com with the value shown.
Install the private key in your mail server or signing software. Keep it secret.
Check the published record with the DKIM Validator, then send a test message and look for dkim=pass in the headers.

What goes into DNS

The record name is the selector, then ._domainkey, then your domain. The value starts with v=DKIM1; k=rsa; p= followed by the public key. A single DNS string is limited to 255 characters, so a 2048-bit record is split into several quoted strings that DNS joins together. The DKIM Generator shows both forms.

Checking the record

Look it up with a command such as dig TXT default._domainkey.example.com, or use the DNS Lookup tool. Then send an email to a mailbox you control and open the message headers. The Authentication-Results line should include dkim=pass.

Alignment, SPF and DMARC

DMARC requires that the domain used for DKIM, or for SPF, matches the visible From domain. Set up SPF and DMARC along with DKIM. A DMARC policy tells receivers what to do when checks fail.

Keys and rotation

Keep the private key out of DNS, source control and chat messages. To rotate keys, create a new selector, publish its record, switch signing to it, and remove the old record after a period when old messages may still be checked.

Several domains and sender addresses

DKIM keys belong to a domain and a selector, not to a mailbox. If you send from addresses on several domains, each domain needs its own key. A key on your main domain also covers its subdomains when DMARC alignment is relaxed, which is the default, but not under strict alignment.

USE THE TOOL

Finish the task with DevUtilityKits

Use the relevant online utility, check the result, and continue with your development workflow.

Open DKIM Generator →Open DKIM Validator →Open SPF Generator →Open DMARC Generator →