# Sample DKIM record > Sample DKIM record: see the selector-scoped DNS name, required public-key tag, and safe example values to compare with provider instructions. A sample DKIM record is a DNS TXT record published at `._domainkey.`. It normally identifies a DKIM public key with `v=DKIM1` and `p=`. The selector and key value must come from your sending provider or mail system. Do not copy a sample key into production because it will not match your sender's private signing key. ## Quick takeaways - A DKIM record is usually a TXT record at a selector-scoped `_domainkey` hostname. - The `p` tag contains the public key that receivers use to verify a DKIM signature. - A selector lets one domain publish separate keys for different sending systems or key rotations. - A DKIM DNS record does not contain the private key used to sign mail. - A public DNS lookup can confirm publication, but it cannot prove that a production message was signed correctly. - DKIM is one part of [email authentication](/learning/email-authentication); DMARC also evaluates alignment with the visible From domain. ## How a DKIM record works [DKIM defined in RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html) uses a public-private key pair. A sending system signs selected parts of an email with its private key and puts the selector, signing domain, and signature data in the message's `DKIM-Signature` header. A receiving system uses the selector and signing domain to find the matching public key in DNS. The record name follows this shape: ```text ._domainkey. ``` For example, a signer using selector `selector1` for `yourdomain.com` causes a receiver to look up: ```text selector1._domainkey.yourdomain.com ``` The selector is not a fixed DKIM word. It is chosen by the system that generates and manages the signing key. That is why one provider's selector, CNAME target, or public-key value is not safe to reuse for another provider or domain. DKIM verification confirms whether the received message's signature matches the published public key and the signed content. It does not by itself establish DMARC alignment. For that distinction, see [how DKIM differs from SPF](/learning/dkim-vs-spf-difference). ## When the sample changes The basic DNS shape remains selector-scoped, but the provider-issued instructions determine the actual record type, hostname, and value. A provider may ask you to publish: - A TXT record containing the public key directly at `._domainkey.yourdomain.com`. - A CNAME record at that selector-scoped hostname that points to a provider-controlled DNS name. - More than one selector during key rotation or when separate mail systems sign for the same domain. [RFC 6376's key-record format](https://www.rfc-editor.org/rfc/rfc6376.html) defines `v=DKIM1` as the version tag and `p=` as the public-key data tag. The standard also defines optional tags, including `k=` for key type, `h=` for acceptable hash algorithms, `s=` for service type, `t=` for flags, and `n=` for notes. Use this decision rule when comparing instructions: - If your provider gives a TXT value, publish that exact generated value at the exact generated hostname. - If your provider gives a CNAME target, publish a CNAME. Do not convert its target into a TXT record. - If the provider rotates a key or supplies multiple selectors, keep each required selector until the provider confirms retirement. - If the public record is present but a delivered message still fails DKIM, inspect the signed message and provider status. DNS alone cannot show whether the application used the expected key. > Do not replace an existing DKIM record before confirming which system uses it. Removing a still-active selector can cause legitimate mail to fail DKIM verification. For a provider-specific DNS task, use the relevant instructions, such as [adding a DKIM record in GoDaddy DNS](/learning/add-dkim-record-godaddy), rather than treating the fictional example below as deployable configuration. ## Worked sample DKIM record This is an illustrative-only TXT record. The hostname, public key, and note are examples. Do not publish these values. ```text Host: selector1._domainkey.yourdomain.com Type: TXT Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAexamplePublicKeyOnly; n=Illustrative DKIM key ``` The record has four useful parts: - `selector1` is the selector named in the email's `DKIM-Signature` header. - `_domainkey` is the DKIM DNS namespace defined by the protocol. - `v=DKIM1` identifies the record format. - `p=` contains the base64-encoded public key used for verification. The `k=rsa` tag identifies an RSA key. [RFC 8301 updates DKIM's cryptographic requirements](https://www.rfc-editor.org/rfc/rfc8301.html): signers must use `rsa-sha256`, and verifiers must support it. Your provider determines its supported key type, selector, and generated DNS value. ![Illustrative DKIM TXT record showing the selector-scoped hostname and the version, key-type, public-key, and note tags](/images/editorial/sample-dkim-record/sample-dkim-record-anatomy.webp "1200x600") *Source: Palisade.* A record can be valid DNS and still fail the mail-flow test. The private key remains in the sending system, and the message must carry a matching DKIM signature. If the public key does not match that private key, verification fails. If the signing domain does not align with the visible From domain under the applicable DMARC policy, the message can also fail DMARC despite a DKIM pass. [DKIM alignment failures need message-level evidence](/learning/why-does-my-dkim-signature-fail-alignment). ## What to check next Start with the evidence you have: - If you have a provider-issued hostname and record value, compare them character for character with the DNS record you published. Confirm whether the provider requested TXT or CNAME. - If you know the sending domain and selector, look up the public selector-scoped record. - If you have a delivered test message, inspect its `DKIM-Signature` and `Authentication-Results` headers. RFC 6376 defines the signature fields, while [RFC 8601 defines the `Authentication-Results` header field](https://www.rfc-editor.org/rfc/rfc8601.html). - If the provider reports verification success, send a real message through the production path and inspect that delivered message. Then review DMARC aggregate reports once they accumulate. A provider indicator verifies the provider's own check. An authoritative DNS query and public resolver check verify publication. A real delivered message verifies the signing path. DMARC reports show patterns across sending sources over time. ## Check the record that is actually published After comparing the sample anatomy with your provider's instructions, inspect the public record for the domain and selector you control. [Check a DKIM record](/tools/dkim) A public lookup cannot enable signing, access a private key, or prove a result for a message it did not inspect. ## Sources and further reading - [RFC 6376: DomainKeys Identified Mail signatures](https://www.rfc-editor.org/rfc/rfc6376.html) - [RFC 8301: DKIM cryptographic requirements](https://www.rfc-editor.org/rfc/rfc8301.html) - [RFC 8601: Authentication-Results header field](https://www.rfc-editor.org/rfc/rfc8601.html) - [Palisade DKIM checker](/tools/dkim) ## Frequently asked questions ### What is a valid DKIM record example? A valid DKIM TXT record commonly has a hostname such as `selector1._domainkey.yourdomain.com` and a value beginning with `v=DKIM1; p=` followed by the sender's generated public key. The actual selector and public key must match the private key used by the sending system. ### What does a DKIM record look like? A DKIM record looks like a DNS record under `_domainkey`, with a selector before it. A direct TXT record usually contains DKIM tags, especially `v=DKIM1` and `p=`. Some providers instead require a CNAME record at the selector hostname. ### How to write a DKIM record? Only write the DKIM record from the exact hostname, record type, and value generated by your email provider or signing system. Copying a sample record will not configure DKIM because its public key will not match your private signing key. ### What type of record should a DKIM be? A DKIM deployment can use a TXT record that publishes a public key, or a CNAME record that delegates the selector hostname to a provider. Use the record type specified in the provider's current setup instructions. ### Can one domain have multiple DKIM records? Yes. A domain can publish multiple DKIM records when each uses a different selector. This supports separate sending systems and key rotation without requiring every sender to use the same public key. ### Does finding a DKIM record prove mail passes DKIM? No. Finding a public record proves that DNS returns a record for that selector. A delivered message's signature and authentication results are needed to verify that the actual sending path signed the message with the matching private key.