What is DKIM?

How does DKIM work?

DKIM works with a pair of keys: a private key that only your mail provider holds and a public key anyone can read in your domain's DNS. Signing and checking happen without you doing anything once it's set up:

1. Your mail server takes the message's body and chosen headers, such as From, To, Subject and Date, and computes a fingerprint of them.
2. It signs that fingerprint with your domain's private key and adds the result to the message as a DKIM-Signature header.
3. The receiving server reads the header, sees which domain and selector signed it, and looks up the public key at selector._domainkey.yourdomain.com.
4. It recomputes the fingerprint and checks the signature with the public key. If anything signed was changed in transit, or the key doesn't match, the check fails.

Because the signature is part of the message, it stays valid when the message is relayed or forwarded, as long as nobody edits the signed parts.

What's inside a DKIM signature?

A DKIM signature is a header made of tag=value pairs that tell the receiver what was signed and where to find the key. The standard defines these main tags:

Tag	Meaning	Example
v=	Version, always 1	v=1
a=	Signing algorithm	a=rsa-sha256
d=	The domain taking responsibility for the message	d=yourcompany.com
s=	The selector, which names the key to use	s=google
h=	The header fields that were signed	h=from:to:subject:date
bh=	A hash of the message body	A long base64 string
b=	The signature itself	A long base64 string
c=	How whitespace and case are normalised before hashing	c=relaxed/relaxed
t=	When it was signed	A timestamp

The d= domain is the one that matters for DMARC: if it matches the domain in the visible From address, DKIM counts as aligned.

What is a DKIM selector?

A selector is a name that lets one domain publish several DKIM keys at once. Each key lives at its own address in DNS, <selector>._domainkey.<domain>, so different services, or old and new keys, never clash. Your Google Workspace key and your newsletter tool's key can sit side by side.

Providers pick the selector for you. Google Workspace's default prefix selector is "google", giving google._domainkey.yourcompany.com. Microsoft 365 uses two for every organisation, selector1._domainkey and selector2._domainkey, published as CNAME records pointing at keys Microsoft manages: one is active and the other waits for the next key rotation.

Which DKIM key length should you use?

Use a 2048-bit RSA key. RFC 8301, the update to DKIM's cryptography, says signers "MUST use RSA keys of at least 1024 bits" and "SHOULD use RSA keys of at least 2048 bits", and it stopped signers using the old SHA-1 hash. Receivers must be able to check keys from 1024 to 4096 bits.

Key	Status	When to use it
RSA 2048-bit	Recommended	The default for Google Workspace and most providers
RSA 1024-bit	Allowed minimum	Only when your DNS host can't store a longer record
RSA under 1024-bit	Not allowed for signing	Never
Ed25519	Added in RFC 8463 (2018)	Alongside an RSA key, since not every receiver checks it

A 2048-bit public key is longer than one DNS text string can hold, so it's split into several strings in one record. Most DNS hosts do this for you; a few older ones can't, which is why 1024-bit keys still exist.

What breaks DKIM?

DKIM breaks when a signed part of the message is changed between sending and delivery, or when the public key can't be found. The usual causes:

• Mailing lists and some security gateways that add a footer, tag the subject line or rewrite links.
• A missing or mistyped DNS record, often a key pasted with a line break or a quote in the wrong place.
• The wrong domain signing: a service signs with its own domain instead of yours, so DKIM passes but doesn't align for DMARC.
• A rotated key removed from DNS while mail signed with it is still being delivered.

How do you set up DKIM?

You set up DKIM by generating a key in your mail provider and publishing its public half in your DNS, then switching signing on.

1. In your provider's admin console, generate a DKIM key for your domain, choosing 2048 bits.
2. Copy the record it gives you: a TXT record (Google) or two CNAME records (Microsoft 365).
3. Add it at your DNS host under the exact name shown, such as google._domainkey.
4. Wait for DNS to update. Google notes its console may keep warning for up to 48 hours.
5. Turn on signing in the console, then send a test message and check for DKIM: PASS.
6. Repeat for every other service that sends as your domain, such as a newsletter or invoicing tool.

How does Mojobase handle DKIM?

For addresses Mojobase hosts on your own domain, Mojobase signs every outgoing message with your domain's DKIM key, so the signature's d= domain matches your From address and DMARC aligns. Its domain page lists the key to publish alongside the other records and checks that it's in place.

If you connect Gmail or Outlook instead, Google or Microsoft keeps signing your mail as before; Mojobase sends through them. Hosted and connected addresses sit in one inbox in Mojobase Email, with the same sorting and AI drafts. More on business email on your own domain.