DKIM Setup Checklist

How DKIM works

The sending service signs selected message headers and body content with a private key. Receivers retrieve the corresponding public key from a selector beneath _domainkey in DNS. A passing signature shows that signed content was not altered and that the signing domain authorised the key.

Deployment checklist

1. Generate the key inside the sending provider; never upload or paste a private key here.
2. Copy the exact TXT or CNAME record supplied for the selector.
3. Allow for DNS propagation, then enable signing in the provider.
4. Send to an independent mailbox and inspect Authentication-Results.
5. Confirm the DKIM domain aligns with the visible From domain for DMARC.
6. Document selectors and rotate keys according to provider guidance.

Do not delete an old selector until messages signed with it have cleared normal delivery and retry windows.

Selector register

Record the selector, provider, signing domain, public-record location, activation date, key length reported by the provider and planned review date. Never place a private signing key in this register.

Prove signing rather than DNS presence

After enabling DKIM, send a message through the exact production route and inspect the received Authentication-Results and DKIM-Signature fields. Confirm the signing domain aligns with the visible From domain used for DMARC.

Rotation without a gap

Publish the new public selector, enable new signing, verify received mail, then retain the old selector through normal delivery and retry windows before removal. Follow the provider's documented rotation procedure.