Browse the Learning Center
DKIM
Selectors, key rotation, body-hash failures, alignment.
42 guides
Read in order
The three records
SPF, DKIM and DMARC explained in the order they make sense. Start here if the acronyms are new.
3 steps
Add a sending platform
Authorise a new ESP without breaking the authentication you already have.
3 steps
Fix a failing sender
Mail is bouncing or landing in spam. Work the causes in order of likelihood.
3 steps
All DKIM guides
DKIM record formatDKIM record format uses a DNS TXT record at selector._domainkey.domain with a required public key in p=. Learn the valid tag structure and core rules.
DKIM fail with domainDKIM fail with domain is not a complete diagnosis. Collect the trusted message result and selector evidence, then repair and retest the same path.
How to set up DKIM for Google WorkspaceDKIM G Suite setup: generate a Google Workspace DKIM key, publish its TXT record, start authentication, and validate a delivered message now.
Generate a DKIM recordGenerate a DKIM record by creating a key pair in your sending service, then publishing its public key at the selector's DNS name for your domain.
PowerDMARC DKIM checker: lookup and re-test workflowPowerDMARC DKIM checker workflow: identify the selector, inspect the published DNS record, correct sender-generated values, and re-test safely.
DKIM fail: body hash did not verify, and how to fix itThis error means the message body changed after it was signed. Here are the five things that alter it in transit, and how to find which one is yours.
GoDaddy DKIM Record: How to Add and Verify ItAdd a GoDaddy DKIM record: publish your sender's exact TXT or CNAME values, verify public DNS, enable signing, and confirm a delivered message is signed.
Dig DKIM recordUse dig to query a DKIM record by selector, interpret TXT or CNAME results, and know when DNS evidence is not a message pass.
What is a DKIM CNAME record and how do you set it up?DKIM CNAME records delegate a DKIM public-key lookup to a provider. Learn how they work, how to publish them, and how to validate DKIM safely.
How do you set up DKIM on Postfix with OpenDKIM?DKIM on Postfix with OpenDKIM requires a matching milter, signing-table mapping, DNS key, and same-path message validation for every sending route.
Why does a Google DMARC report show DKIM fail?Interpret a Google DMARC aggregate report with DKIM fail, identify the sender, make a narrow repair, and validate the same path.
Why does my DKIM signature fail alignment and how can I fix it?DKIM signature alignment fails when a passing DKIM d= domain does not align with the visible From domain. Inspect headers, fix signing identity, and.
Can an email have multiple DKIM signatures?Can an email have multiple DKIM signatures? Yes. Learn how receivers verify each signature and which passing signature can satisfy DMARC in practice.
How do you manage multiple DKIM records for one domain?How to manage multiple DKIM records: use unique selectors, publish each key safely, rotate without breaking mail, and validate delivered messages.
How often should you rotate DKIM keys?How often should you rotate DKIM keys? DKIM sets no universal interval. Use a documented risk-based schedule and rotate immediately after exposure.
Email authentication for Gmail: SPF, DKIM, and DMARC requirementsEmail authentication for Gmail requires SPF or DKIM for every sender, and SPF, DKIM, and DMARC together once volume reaches 5,000 messages a day.
What does a DKIM record look like?A DKIM record is a DNS TXT entry at selector._domainkey.yourdomain.com with a v=DKIM1; k=rsa; p=... tag list. See a worked example and how to check yours.
Generate DKIM keysGenerate DKIM keys by creating a key pair in your sending system, keeping the private key there, and publishing its public key in DNS for receiver.
How to get a DKIM recordHow to get a DKIM record: generate the selector and key with your sender, publish its exact DNS value, then verify a delivered message passes.
How do I set up DMARC, SPF, and DKIM on DreamHost?How to set up DMARC, SPF, and DKIM on DreamHost: add the required DNS records, validate the live sending path, and review DMARC reports safely.
Why do phishing emails pass SPF and DKIM checks?Why do phishing emails pass SPF and DKIM checks? They authenticate a sending domain, not whether a message, brand claim, or sender identity is honest.
How to configure SPF and DKIM for ChargebeeConfigure SPF and DKIM for Chargebee by authenticating the custom SMTP provider, connecting it in Chargebee, and validating a real notification.
How do I set up SPF and DKIM for SendGrid?SendGrid SPF and DKIM setup: authenticate a domain, publish account-generated DNS records, verify SendGrid, inspect headers, and validate DMARC.
How do I set up SPF and DKIM for Amazon SES?Set up SPF and DKIM for Amazon SES by publishing identity-specific Easy DKIM records, configuring custom MAIL FROM, and validating real mail.
HubSpot SPF and DKIM setup: connect and verifyHubSpot SPF and DKIM setup: connect your sending domain, publish account-generated DNS records, verify HubSpot, and validate a real message.
Cloudflare DKIM setupCloudflare DKIM setup starts with sender-generated DNS values, then requires DNS, sender, delivered-message, and DMARC validation for each sending path.
How to set up DKIM keys in SalesforceDKIM keys in Salesforce: create primary and alternate CNAME records, activate signing, and validate DNS, headers, and DMARC reporting for Salesforce email.
How to set up SPF and DKIM for Brevo (formerly Sendinblue)How to set up SPF and DKIM for Brevo: authenticate the sending domain, publish Brevo's account-generated DNS records, then validate a real message.
How do I set up SPF and DKIM for Customer.io?Customer.io SPF and DKIM setup: add a sending domain, publish its account-generated DNS records, verify delivery, and check DMARC alignment.
How do I set up SPF and DKIM for Klaviyo?How to set up SPF and DKIM for Klaviyo: configure a branded sending domain, publish Klaviyo's DNS records, verify it, and validate DMARC alignment.
How do I set up SPF and DKIM for Mailchimp?Mailchimp SPF and DKIM setup: authenticate a sending domain with Entri or two CNAME records, preserve SPF, add DMARC, and validate a campaign.
How do I set up SPF and DKIM for Zoho Campaigns?Set up SPF and DKIM for Zoho Campaigns by verifying the sender, publishing Zoho's DNS values, testing a delivered campaign, and checking DMARC.
DKIM checker domainDKIM checker domain guide: check public DKIM records, interpret selector results, repair the right DNS layer, and retest a real production message.
Mimecast DKIM setupSet up Mimecast outbound DKIM signing: create the DNS Authentication definition, publish its generated TXT key, apply a policy, and validate mail.
Domain key and DKIM: what the phrase meansDomain key DKIM means DomainKeys Identified Mail, while legacy DomainKeys is obsolete. Learn how DKIM signatures and selector records work today.
What does the DMARC adkim tag do?DMARC adkim sets DKIM alignment to relaxed or strict. Learn how each mode compares domains, affects senders, and how to validate a safe change.
Why does a DKIM checker say no record found?DKIM checker says no record found? Verify the selector and signing domain, inspect the exact DNS query, fix the public record, and retest mail.
Mailgun SPF and DKIM Setup: Exact DNS RecordsSet up Mailgun SPF and DKIM with the exact DNS records. Learn when to use DKIM CNAMEs, why send-only domains skip Mailgun MX, and how to verify alignment.
How do I set up SPF and DKIM for Postmark?Postmark authenticates via its own Return-Path, so the include is unnecessary. Real setup: one DKIM TXT record plus a Return-Path CNAME for alignment.
DKIM vs SPF: The Difference and Why It MattersSPF checks whether the sending server is authorized; DKIM signs the message so tampering shows. Here is how they differ and why you need both.
What is DKIM2 and how does it fix DKIM replay and forwarding breakage?DKIM2 is an in-progress IETF standard in which each server that handles a message adds its own signature. That chain stops DKIM replay and forwarding loss.
What is DKIM and how does DomainKeys Identified Mail sign email?What DKIM is, how the public/private key signature works, the exact DNS record to publish, current key-length guidance, and how it feeds SPF and DMARC.