How DKIM works
Your email provider signs each outgoing message with a private key. The signature travels in a DKIM-Signature header, which names your domain (d=) and a selector (s=). The receiving server fetches the matching public key from DNS at selector._domainkey.yourdomain and checks that the message hasn't been changed since it was signed.
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."Because the signature is part of the message, DKIM still passes when mail is forwarded, which is where SPF often breaks. That makes it the most reliable way to pass DMARC.
Turning on DKIM
Microsoft 365
In the Microsoft Defender portal, go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, then DKIM. Select your domain, publish the two CNAME records it shows you (selector1._domainkey and selector2._domainkey) at your DNS host, wait for them to appear, then switch signing on.
Google Workspace
In the Admin console, go to Apps, Google Workspace, Gmail, Authenticate email. Generate a 2048-bit key, add the TXT record it gives you at google._domainkey, wait for DNS to update, then click Start authentication.
Other services
Newsletter, CRM and invoicing tools that send as your domain each have their own DKIM set-up, usually one or two CNAME records. Without them, those messages fail DMARC once you enforce it.
About selectors, and why a checker can miss yours
DNS has no way to list every DKIM key on a domain, so any outside checker has to guess selector names. Our free check tries the names most providers use: default, google, selector1, selector2, k1, s1, mail and dkim. If your provider uses a custom selector, the check may report no key even though DKIM works.
To confirm, open an email you sent in your recipient's mail program, view the original message or headers, and look for DKIM-Signature. The s= value is your selector, and an Authentication-Results line with dkim=pass means it works.
Good DKIM habits
- Use 2048-bit keys. 1024-bit keys still work but are the minimum.
- Rotate keys occasionally. Microsoft 365's two selectors exist so you can switch between them.
- Remove keys for services you no longer use, so nobody else can sign with them.