DKIM Setup Guide

The DKIM Setup Guide provides step-by-step instructions for enabling DKIM on your domain for the most popular email providers. Once you complete the steps, you can verify your configuration directly within the tool.

Tool URL:/tools/dkim-setup

What is DKIM?

DKIM (DomainKeys Identified Mail) is a system that attaches a digital signature to every email your domain sends. The receiving server verifies this signature against a public key stored in your DNS. If the signature is valid, it proves the email was sent by an authorized sender and was not altered in transit.

DKIM is one of the two authentication methods (along with SPF) that DMARC checks when deciding whether to enforce your policy. Without DKIM, your DMARC implementation is less robust, especially when emails are forwarded.

How DKIM keys work with email providers

Unlike some other DNS records, you do not generate DKIM keys yourself for most email services. Providers like Google Workspace, Microsoft 365, Mailchimp, and SendGrid generate and manage the DKIM keys on their own infrastructure. Your job is to add the DNS records they provide to your domain, which allows receiving servers to find and verify those keys.

If you run your own mail server (e.g. Postfix), you would generate your own DKIM keys. This guide focuses on the more common case of using a managed email service.

How to use the DKIM Setup Guide

Step 1 — Select your email provider

Open the DKIM Setup Guide at /tools/dkim-setup. You will see a grid of supported providers. Click the card for your email provider.

Supported providers include:

  • Google Workspace
  • Microsoft 365
  • Mailchimp
  • Brevo (formerly Sendinblue)
  • Klaviyo
  • SendGrid
  • Mailgun
  • Amazon SES

If your provider is not listed, use the provider's own documentation to find their DKIM setup instructions. The verification step at the end of this tool still works for any provider.

Step 2 — Follow the setup steps

After selecting your provider, the guide displays numbered steps tailored to that provider's interface. Follow each step in order.

The steps typically involve:

  1. Signing in to your provider's admin panel or settings area.
  2. Finding the DKIM or email authentication section.
  3. Generating or enabling DKIM signing for your domain.
  4. Copying the DNS record (usually a TXT or CNAME record) that your provider displays.
  5. Adding that DNS record to your domain's DNS settings at your DNS provider.
  6. Returning to your email provider to confirm or activate the setup.

Some providers require you to add CNAME records rather than TXT records. Both types serve the same purpose — they point to the provider's signing infrastructure so that the public key can be looked up by receiving servers.

The guide also shows a note about the default selector for that provider. The selector is the prefix used in the DNS lookup (for example, google._domainkey.yourdomain.com for Google Workspace, where google is the selector).

Step 3 — Wait for DNS propagation

After adding the DNS record, it may take up to 48 hours to propagate globally. In practice, it often takes effect within a few minutes to an hour.

Some providers have a "Verify" button you must click after adding the DNS record. If the provider shows a verification error immediately after you add the record, wait 10–15 minutes and try again.

Step 4 — Verify your DKIM record

Once the DNS record has propagated, scroll down to the Verify Your DKIM Record section of the guide.

  1. Enter your domain name in the Domain field (e.g. yourdomain.com).
  2. Check the Selector field — it is pre-filled with the default selector for your chosen provider. You can change it if you used a different selector.
  3. Click Verify DKIM.

You will see one of two results:

  • DKIM record found — Your DKIM configuration is working. The result shows the key type (usually RSA) and key length in bits (2048 is recommended; 1024 is the minimum).
  • DKIM record not found yet — The DNS record has not propagated yet, or there was an error in the setup. Wait and try again. If the problem persists after 48 hours, go back and repeat the setup steps, paying close attention to the exact host/name value required for the DNS record.

Step 5 — Change provider (optional)

Click Change provider at the top of the guide to go back to the provider selection grid. Use this if you need to set up DKIM for a second email service.

Tips for common providers

Google Workspace

Google generates the DKIM key for you in the Admin Console. The key bit length is configurable — choose 2048 bits for better security. The default selector is google.

Microsoft 365

Microsoft uses two selectors (selector1 and selector2) for automatic key rotation. You will need to add two CNAME records to your DNS. Both must be added for DKIM to work.

Mailchimp

Mailchimp uses CNAME records that point to their signing infrastructure. The default selector is k1. You do not directly handle the public key.

SendGrid

SendGrid provides three CNAME records as part of its Domain Authentication process. These cover both SPF and DKIM in a single setup. Add all three records.

Amazon SES

Amazon SES uses Easy DKIM with three auto-generated CNAME records. The selectors are generated uniquely per domain and change automatically for key rotation. Verification can take up to 72 hours.

Common questions

Do I need to configure DKIM for every email service I use?

Yes. Every service that sends email on behalf of your domain should be configured with DKIM. If a service sends email from your domain without DKIM, those emails may fail DMARC if your SPF record also does not cover that service.

What key length should I use?

Use 2048 bits whenever your provider supports it. The 1024-bit RSA key size is considered weak by modern standards. Providers that only offer 1024-bit keys are a security concern — check whether they have a newer option or a key rotation roadmap.

My provider is not listed. What do I do?

Search for "[your provider name] DKIM setup" to find their documentation. Once you have added the DNS record from your provider, use the Verify section at the bottom of this guide to confirm it is working. You can enter any selector in the Selector field.

Can I have multiple DKIM selectors for the same domain?

Yes. DKIM selectors allow multiple signing keys to coexist on the same domain. Each email provider uses its own selector, so there is no conflict between them.

Related tools