DKIM Setup Guide: Complete Step-by-Step Configuration

What Is DKIM and Why It's Critical#

DKIM (DomainKeys Identified Mail) is a digital signature for your emails. It proves that an email claiming to be from your domain actually came from your mailbox—not from an attacker who hacked something else.

In February 2026: Gmail and Yahoo require DKIM for email delivery. Emails without it are rejected.

This guide walks you through DKIM setup in 20 minutes.

How DKIM Works#

DKIM uses public/private key cryptography:

1. Your mail server signs outgoing emails with a private key (secret)
2. The signature is attached to each email header
3. Recipients verify the signature using your public key (in DNS)
4. If signature validates: Email hasn't been tampered with ✅
5. If signature fails: Email was forged or modified ❌

Understanding DKIM Selectors#

This is where most people get confused.

DKIM records live at a specific DNS location: [selector]._domainkey.yourdomain.com

Examples:

• default._domainkey.yourdomain.com
• google._domainkey.yourdomain.com
• s1._domainkey.yourdomain.com
• sendgrid._domainkey.yourdomain.com

The selector is just a label. Your email provider chooses it. Common selectors:

Service	Selector
Google Workspace	google, default
Microsoft 365	selector1, selector2
SendGrid	default, sendgrid
Mailgun	default, k1
Zoho	s1, s2, s3

You cannot guess the selector. You must find it from your email provider's setup instructions.

Step 1: Find Your DKIM Selector#

For Google Workspace:

1. Go to admin.google.com
2. Navigate to Security → Authentication → Domain management
3. Find the DKIM selector (usually "google" or "default")

For Microsoft 365:

1. Go to admin.microsoft.com
2. Navigate to Settings → Domains
3. Find the DKIM section (usually "selector1")

For SendGrid:

1. Go to SendGrid settings
2. Find API keys and DKIM config
3. Selector is usually "default" or "sendgrid"

For Mailgun:

1. Go to Mailgun dashboard
2. Find Domain settings
3. Selector is in DKIM configuration

Not using a third-party service? You're on your own mail server. Contact your hosting provider for the DKIM selector.

Step 2: Generate or Retrieve DKIM Public Key#

Your email provider generates a public key. You don't create it—they create it, you copy it.

The key looks like:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdjqFtUGxC...

Where to find it:

• Google Workspace: Copy from admin console
• Microsoft 365: Copy from Exchange admin center
• SendGrid: Dashboard → DKIM settings
• Mailgun: Domain settings → DKIM
• Other providers: Check their documentation

Step 3: Publish DKIM Record to DNS#

Once you have the public key, add it to DNS:

1. Go to your DNS provider (Cloudflare, Route 53, GoDaddy, etc.)
2. Add TXT record with:
   • Name: [selector]._domainkey (e.g., google._domainkey)
   • Value: The public key from step 2
   • TTL: 3600 (or default)
3. Save and wait 5-15 minutes

Step 4: Test DKIM Configuration#

Use these free tools to verify:

Option 1: Nova Uptime Email Health Checker

• Go to /tools/email-health
• Enter your domain
• Check DKIM status

Option 2: MXToolbox

• Go to mxtoolbox.com
• Use DKIM checker
• Enter selector and domain

Option 3: Mail-tester

• Go to mail-tester.com
• Send test email from your domain
• Check DKIM signature in headers

Common DKIM Mistakes#

Mistake 1: Wrong Selector#

If your mail server signs with selector google but DNS has selector default, DKIM validation fails.

Fix: Verify the selector matches exactly what your mail server is using.

Mistake 2: Public Key Truncated in DNS#

Some DNS providers truncate long TXT records. If the public key is cut off, DKIM fails.

Fix: Use DNS provider that supports full-length TXT records, or split the key using quotation marks.

Mistake 3: Multiple DKIM Records (Old vs New)#

When migrating email providers, you might have old DKIM keys still in DNS.

Good: Multiple selectors from different providers

google._domainkey  → Google's public key
s1._domainkey      → SendGrid's public key

Bad: Multiple records for the same selector (DNS reads only first)

Fix: Remove old selectors, keep only active ones.

Mistake 4: Not Rotating Keys#

If your private key is compromised, keep using it anyway. Attackers can forge emails.

Fix: Rotate keys annually minimum. Disable old keys in DNS after confirming new ones work.

Mistake 5: Using Weak Keys (1024-bit)#

1024-bit DKIM keys are cryptographically weak. Attackers can forge signatures.

Fix: Use 2048-bit keys minimum. Check with your email provider what they support.

Multiple Email Providers? You Need Multiple Selectors#

If you use both Google Workspace AND SendGrid:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3... → publish to google._domainkey
v=DKIM1; k=rsa; p=... (different) ...   → publish to sendgrid._domainkey

Both work independently. Emails from Google are verified with Google's key. Emails from SendGrid are verified with SendGrid's key.

DKIM + SPF + DMARC#

DKIM is part of the authentication triplet:

• SPF: "Is the server authorized?"
• DKIM: "Is the message authentic?"
• DMARC: "Do both pass and align?"

Set up all three. Nova Uptime checks all three automatically—run your first email health check.

After Publishing: Monitoring#

Week 1: Monitor email delivery, check spam folder Weekly: Use Nova Uptime Email Health Checker to verify DKIM status Monthly: Check no old selectors are lingering in DNS

Summary#

1. Find your DKIM selector (from email provider)
2. Get the public key (from email provider)
3. Publish to DNS at [selector]._domainkey.yourdomain.com
4. Test with verification tools
5. Wait 1 week, monitor email delivery
6. Keep records clean (remove old selectors)

DKIM is mandatory in 2026. Setup takes 20 minutes. Missing it costs revenue.

Monitor all three authentication protocols automatically: Nova Uptime Email Health Checker. Free. 🚀

Related Reading#

• DKIM Check & Setup Guide — Comprehensive DKIM troubleshooting
• DKIM Selector Detection Guide — Find and verify DKIM selectors
• SPF Record Setup & Check Guide — SPF configuration alongside DKIM
• DMARC Setup: None to Reject — DMARC requires DKIM alignment
• Email Health Checker Guide — Full authentication audit
• Free DKIM Checker — Validate your DKIM record instantly