DKIM Signature

What DKIM is in plain terms, how to add the DNS record, check the signature in email headers and choose a key length. + 6 mistakes that make DKIM checks fail.

DKIM (DomainKeys Identified Mail) is a digital signature that the mail server adds to every outgoing email. The public key is published in the domain's DNS, and the receiving server uses it to verify that the email came from your domain and was not altered in transit. Gmail requires DKIM from anyone sending more than 5,000 emails a day.

Below is a step-by-step setup guide and six mistakes that leave DKIM failing even though the DNS record exists. Each comes with the symptom in the headers and the fix.

At a glance: DKIM in numbers

Fact	Value	Source
Standard	RFC 6376, 2011	IETF
Minimum RSA key length	1,024 bits, 2,048 recommended	RFC 8301, 2018
Gmail key requirement	at least 1,024 bits, preferably 2,048	Google, 2024
When DKIM is mandatory in Gmail and Outlook	from 5,000 emails a day	Google, dmarcian
Which domain Mail.ru Postmaster statistics are built on	the domain in the DKIM signature (d= tag)	Mail.ru

How a DKIM signature works

DKIM uses a key pair: the private key lives on the mail server, the public key in DNS.

The sending server computes a hash of the email body and selected headers (From, Subject, Date).
It signs the hash with the private key and adds a DKIM-Signature header with the domain (d=) and selector (s=).
The receiving server fetches the public key from selector._domainkey.domain.
It verifies the signature. If the email was altered in transit or the key doesn't match, the result is fail.

The key difference from SPF: DKIM survives forwarding. SPF checks the server's IP, which changes when an email is forwarded. The DKIM signature stays in the email as long as its content is unchanged.

What a DKIM record and signature are made of

The DNS record is a TXT record on the selector._domainkey subdomain:

mail._domainkey.company.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

The signature in the email is a header with a set of tags:

Tag	Where	Meaning
`v=DKIM 1`	DNS	Record version
`k=rsa`	DNS	Key algorithm
`p=`	DNS	Public key; an empty value means the key is revoked
`d=`	Email	The domain that signed the email
`s=`	Email	Selector used to find the key in DNS
`h=`	Email	Signed headers
`bh=` / `b=`	Email	Body hash and the signature itself

How to set up DKIM for a domain

Setup takes 10–15 minutes plus time for DNS to update.

Generate a key in the admin panel of your mail provider (Yandex 360, VK WorkSpace, Google Workspace, Microsoft 365) or sending tool. Choose 2,048 bits if you have the option.
Copy the host and value of the TXT record in full, without line breaks.
Add the TXT record to DNS: a host like mail._domainkey and a value like v=DKIM1; k=rsa; p=....
Turn on signing in your mail provider's panel once the record has propagated. Many providers have a separate button for this.
Check the result — see the section below.

If several services send your email, each gets its own selector and its own DKIM record. Unlike SPF, you can have as many as you need.

In Holymailer, DKIM together with SPF, DMARC and MX is configured automatically for every domain and checked daily.

How to check a DKIM signature

Send an email to Gmail or Mail.ru and open the headers. Look for the Authentication-Results line:

Authentication-Results: mx.google.com; dkim=pass header.d=company.com header.s=mail; spf=pass smtp.mailfrom=company.com; dmarc=pass header.from=company.com

Check two things: dkim=pass, and that header.d matches the domain in the From field. To confirm the key is published, run dig TXT mail._domainkey.company.com +short. Mail.ru's help (in Russian) describes the same check.

6 mistakes that make DKIM fail

A record in DNS doesn't yet mean DKIM works. Here's what breaks most often.

#	Mistake	Symptom in headers	Fix
1	Record published, but signing not enabled at the mail provider	`dkim=none` or no DKIM-Signature header	Click “Enable signing” in the admin panel
2	Key truncated or corrupted when copying: spaces, line breaks, extra quotes	`dkim=fail` or `permerror`	Copy the key again; split a long key into 255-character strings if your DNS provider requires it
3	Wrong host: the DNS panel appended the domain, giving `mail._domainkey.company.com.company.com`	`dkim=temperr or` or permerror with “no key for signature”	Enter only `mail._domainke y` as the host
4	The d= domain doesn't match the From domain	`dkim=pass` but `dmarc=fail`	Set up signing with your own domain in the sending tool
5	Emails are signed by the sending tool's domain, not yours	`header.d=` shows someone else's domain	Connect your own DKIM. Otherwise reputation and Mail.ru Postmaster statistics go to the tool's domain
6	Short key: 512 or 768 bits	`dkim=fail` or “policy (weak key)” in Gmail	Generate a new 2,048-bit key

If DKIM passes and emails still land in spam, the cause is no longer authentication. Run the 15-minute deliverability diagnostic and check whether the mailbox is warmed up.

Frequently asked questions

What is DKIM in simple terms?

It's a digital signature on an email. It proves to the recipient that the email was sent from your domain and nobody changed it along the way.

How is DKIM different from SPF?

SPF checks which server the email came from. DKIM checks the email itself through a signature, which is why it survives forwarding. You need both.

Which DKIM key length should I choose: 1024 or 2048?

2,048 bits. RFC 8301 requires at least 1,024 and recommends 2,048, and Google also advises 2,048 if your DNS provider supports it.

Why does DKIM pass but DMARC fail?

The email is signed by a domain that doesn't match the From domain — most often the sending tool's domain. Set up signing with your own domain.

Why does DKIM break when an email is forwarded?

The signature breaks if an intermediate server altered the email: added an antivirus footer, rewrote the subject or links. With plain forwarding and no changes, the signature survives.

Can a domain have several DKIM records?

Yes. Each service has its own selector, for example mail._domainkey for email and crm._domainkey for your CRM, and the records don't conflict.

Sources

RFC 6376: DomainKeys Identified Mail Signatures — the DKIM standard, 2011.
RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM — key length requirements, 2018.
Google: Email sender guidelines — in force since February 1, 2024.
dmarcian: Microsoft Enforces SPF, DKIM, DMARC — since May 5, 2025.
Mail.ru: domain statistics in Postmaster (in Russian).
Mail.ru: how to check SPF, DKIM, DMARC in an email (in Russian).

JSON-LD markup

{ "@context": "https://schema.org", "@graph": [ { "@type": "Article", "inLanguage": "en", "headline": "DKIM Signature: Setup, Checks and 6 Common Mistakes", "author": {"@type": "Person", "name": "[Author name]", "jobTitle": "[Job title]"}, "datePublished": "2026-09-30", "dateModified": "2026-09-30", "publisher": {"@type": "Organization", "name": "Holymailer", "url": "https://holymailer.com"} }, { "@type": "HowTo", "name": "How to set up DKIM for a domain", "step": [ {"@type": "HowToStep", "text": "Generate a 2048-bit key in your mail provider's admin panel."}, {"@type": "HowToStep", "text": "Copy the host and value of the TXT record in full."}, {"@type": "HowToStep", "text": "Add a TXT record with a host like mail._domainkey to DNS."}, {"@type": "HowToStep", "text": "Turn on signing in your mail provider's panel."}, {"@type": "HowToStep", "text": "Check for dkim=pass and that header.d matches the sender domain in a test email's headers."} ] }, { "@type": "FAQPage", "mainEntity": [ {"@type": "Question", "name": "What is DKIM in simple terms?", "acceptedAnswer": {"@type": "Answer", "text": "It's a digital signature on an email. It proves to the recipient that the email was sent from your domain and nobody changed it along the way."}}, {"@type": "Question", "name": "How is DKIM different from SPF?", "acceptedAnswer": {"@type": "Answer", "text": "SPF checks which server the email came from. DKIM checks the email itself through a signature, which is why it survives forwarding."}}, {"@type": "Question", "name": "Which DKIM key length should I choose: 1024 or 2048?", "acceptedAnswer": {"@type": "Answer", "text": "2048 bits. RFC 8301 requires at least 1024 and recommends 2048, and Google also advises 2048."}}, {"@type": "Question", "name": "Why does DKIM pass but DMARC fail?", "acceptedAnswer": {"@type": "Answer", "text": "The email is signed by a domain that doesn't match the From domain, most often the sending tool's domain. Set up signing with your own domain."}}, {"@type": "Question", "name": "Why does DKIM break when an email is forwarded?", "acceptedAnswer": {"@type": "Answer", "text": "The signature breaks if an intermediate server altered the email: added a footer, rewrote the subject or links. With plain forwarding and no changes, the signature survives."}}, {"@type": "Question", "name": "Can a domain have several DKIM records?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Each service has its own selector, for example mail._domainkey and crm._domainkey, and the records don't conflict."}} ] } ] }