DKIM DNS record example

A DKIM DNS record usually publishes a public key at a selector-specific hostname such as selector1._domainkey.yourdomain.com. The record is commonly a TXT record whose value begins with v=DKIM1 and includes p= followed by the public key. Use the selector and value generated for your own sending account. An example shows the structure, but it is not safe to publish as a working record.

How a DKIM DNS record works

DKIM lets a receiving mail system retrieve a public key from DNS and use it to verify a signature attached to an email. The sending system keeps the matching private key. The public key belongs in DNS because receivers need it, while the private key must remain under the sender's control.

The DNS name and DNS value answer different questions. The name tells a receiver where to fetch a key. The tags describe the key found at that name.

The selector identifies a particular DKIM key

The selector is the first label in the DKIM DNS name. A signer places the selector in its DKIM-Signature header, then a receiver combines it with the signing domain to construct the DNS query. RFC 6376 defines this query pattern as:

<selector>._domainkey.<signing-domain>

For an illustrative sender using selector1 and yourdomain.com, the public-key record is queried at:

selector1._domainkey.yourdomain.com

A selector lets one domain publish more than one DKIM key at the same time. That supports separate sending systems and key rotation without forcing all mail streams to use one key. For the broader signing and verification flow, see what DKIM is.

The record value carries the public-key information

RFC 6376 defines DKIM key records as tag-value lists. A typical direct TXT record has these visible fields:

• v=DKIM1 identifies the record as a DKIM key record.
• k=rsa identifies RSA as the key type. RFC 6376 defines RSA as the default when k is omitted.
• p= contains the Base64-encoded public key.

Do not copy the p= value from an example, another tenant, or an old DNS record. Publish only the selector, record type, target, and key material issued for the exact sending service and domain.

When a DKIM record example changes

The structural example changes based on how the sending service manages DKIM.

A direct DKIM TXT record publishes the public key in your DNS zone. In that case, the owner name follows the selector pattern and the TXT value includes v=DKIM1 and p=.

A CNAME-based arrangement delegates the selector hostname to a provider-managed DNS name. The provider supplies the exact CNAME target. A CNAME target is account-specific, so it should never be guessed or copied from another organization. The record may still lead a receiver to DKIM public-key data, but the DNS record you publish is a CNAME rather than a direct TXT value.

Use this decision rule:

• If the sender's instruction says TXT, publish the provided selector hostname and DKIM tag-value string as a TXT record.
• If the sender's instruction says CNAME, publish the provided selector hostname and exact CNAME target.
• If you only have a delivered message, read its d= signing domain and s= selector, then look up ._domainkey..
• If the selector or DNS value is missing, obtain it from the sending service before editing DNS.

Record type: TXT
Host/name: selector1._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=BASE64_ENCODED_PUBLIC_KEY_FROM_YOUR_SENDER