DKIM record format

When a DKIM record is valid, delegated, or unusable

A minimum valid DKIM key record can contain only p=. In practice, records commonly begin with v=DKIM1; followed by k= and p=. A record that starts with another version value must be discarded by a verifier.

Treat these as separate checks:

• The selector name must match the s= value in the message signature.
• The domain after _domainkey must match the signature's d= value.
• The p= value must be the public key generated for that selector.
• The selector must return one usable TXT record. RFC 6376 says results are undefined when multiple TXT records exist for a selector.
• Long TXT values may be split into quoted DNS strings, but resolvers must concatenate them with no intervening whitespace. A space inserted into the public key changes its value.

Do not replace an existing selector record with a new value until you know which sender uses it. Removing or changing the public key before the sender changes its matching private key can make legitimate DKIM signatures fail.

A CNAME changes the lookup path, not the DKIM format. RFC 1034's CNAME rules allow a DNS name to be an alias for another canonical name. A sending vendor may ask you to publish a CNAME at selector1._domainkey.example.com that points to its hostname. The resolver follows that alias and retrieves the TXT record at the target. A CNAME node cannot also hold a TXT record.

This distinction matters when reviewing vendor instructions. The record at your selector can be a CNAME delegation, while the DKIM key record that the verifier reads remains a TXT record. For that vendor-managed pattern, see what a DKIM CNAME record is.

For RSA keys, RFC 6376 requires signers to use at least 1024-bit keys for long-lived keys. Google's Gmail sender guidance requires at least 1024 bits for personal Gmail and recommends 2048 bits where the DNS provider supports it. RFC 6376 also notes that large keys can encounter DNS response-size constraints.

Worked DKIM TXT record example

RFC 6376 Appendix C provides this illustrative public-key record. The $ORIGIN line means the full owner name is brisbane._domainkey.example.org.

$ORIGIN _domainkey.example.org.
brisbane IN TXT ("v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ"
                 "KBgQDwIRP/UC3SBsEmGqZ9ZJW3/DkMoGeLnQg1fWn7/zYt"
                 "IxN2SnFCjxOCKG9v3b4jYfcTNh5ijSsq631uBItLa7od+v"
                 "/RtdC2UzJ1lWT947qR+Rcac2gbto/NMqJ0fzfVjH4OuKhi"
                 "tdY9tf6mcwGjaNBcWToIMmPSPDdQPNUYckcQ2QIDAQAB")

The quoted strings form one logical TXT value. They do not add spaces between lines. In the RFC's matching signature example, s=brisbane identifies the selector and d=example.com identifies the signing domain.

That example shows the format, not a reusable key. A real record needs the selector and p= value generated by the exact sender that will sign messages. If you need a visual example rather than a grammar explanation, read what a DKIM record looks like.

Check the record against the message evidence

Start with the evidence you have:

• If you have a delivered message, inspect its DKIM-Signature header for d= and s=. Those values produce the exact DNS name to query.
• If you have only a domain and selector, use dig or another DNS lookup to retrieve the TXT or CNAME response. This DKIM dig guide covers the command and how to interpret the result.
• If DNS looks correct, check the sending platform's DKIM verification status and send a new message through the same production path.
• Then inspect the delivered message's authentication results. A published public key does not prove that the application used the matching private key or that the signature passed.

Look up the selector record you found

When you have the domain and selector from a DKIM-Signature header, query that exact hostname and compare the DNS answer with the sending platform's generated record.

Inspect a DKIM record with dig

A DNS lookup cannot prove that the application signed a specific message, that the public key matches its private key, or that a receiving mailbox provider accepted the message.