Glossary: deliverability
What is DKIM (DomainKeys Identified Mail)?
DKIM, short for DomainKeys Identified Mail, is an email authentication method that adds a digital signature to every message. The receiving server uses a public key published in the sender's DNS to confirm that the message was signed by that domain and was not changed on the way.
The four pieces of DKIM
Private key
Kept by the sending server
Public key
Published in your DNS
Selector
Tells receivers which key to fetch
Signature
Added to every email header
DKIM works with four pieces.
DKIM uses a pair of keys. One signs the mail and stays secret. The other is public, so anyone can check the signature.
The private key signs each message.
It is kept by the sending server, which uses it to create a signature from the message's headers and body.
The public key sits in DNS.
It is published in your DNS as a TXT record, so any receiving server can fetch it.
The selector points to the right key.
A short label in the signature tells receivers which key to fetch, which lets one domain use several keys.
The signature travels with the email.
It is added to every email header as a DKIM-Signature line that names the signing domain and the selector.
Here is a DKIM check for an invented company.
Imagine Elmsward, an invented insurance software company, with the sending domain elmsward-mail.example. Its mail host signs every message with a private key and adds a header containing d= with the signing domain, elmsward-mail.example, and s= with the selector, key1.
The receiving server reads those two values and fetches the public key from the DNS name key1._domainkey.elmsward-mail.example, where _domainkey is the fixed label every DKIM record uses. It uses the key to check the signature. If the message was changed after signing, or was signed with a different key, the check fails.
Where a receiver finds Elmsward's public key
key1._domainkey.elmsward-mail.example
- key1
- The selector, from s= in the signature
- _domainkey
- The fixed label every DKIM record uses
- elmsward-mail.example
- The signing domain, from d= in the signature
Set up DKIM in four steps.
Your mail host creates the keys. Your part is publishing the public one and switching signing on.
The four steps in order
- 1Generate keys
- 2Publish
- 3Turn on
- 4Test
- 1
Generate keys in your mail host.
The host keeps the private key and shows you the public record to publish.
- 2
Publish the public key in DNS.
Add the TXT record under the selector name the host gives you.
- 3
Turn on signing.
Enable DKIM for the domain so every outgoing message is signed.
- 4
Test with a real email.
Send a message and read its headers. They show whether DKIM passed and which domain signed it.
Prymatica configures your sending domains and mailboxes with proper SPF, DKIM and DMARC settings, then monitors deliverability while your campaigns run. See how Prymatica's cold email process works.
Teams make these mistakes with DKIM.
Signing is never switched on.
Publishing the DNS record is half the job. Until the mail host signs, there is nothing to verify.
Mail is signed with someone else's domain.
A signature from your mail host's default domain does not match your From address, so DMARC cannot use it.
The DNS record is pasted wrongly.
A missing character in a long key breaks every check. Test after publishing.
Questions
People ask these questions about DKIM.
What does DKIM stand for?
DomainKeys Identified Mail. It is a published standard for signing email so that the receiver can verify which domain took responsibility for the message.
What is a DKIM selector?
A selector is a short name that points to one specific public key in your DNS. It appears in the signature as s= and lets a domain run several keys at once, for example one per sending service.
What is the difference between SPF and DKIM?
SPF checks whether the sending server is allowed to send for the domain. DKIM checks a signature attached to the message itself. A DKIM signature can survive forwarding, where SPF often fails, so the two cover for each other.
Does DKIM encrypt email?
No. DKIM signs a message so that changes can be detected and the signing domain is known. The content stays readable. Encryption is a separate matter.
Want your inbox filled with qualified leads?
Let's scale together. Book a free intro call and we'll show you exactly how we'll fill your pipeline with meetings from the industries you want to target.
No contracts. Start free. Cancel anytime.