DKIM Record Example: DNS Name, Value, and Setup Checks
DKIM (DomainKeys Identified Mail) lets a sending system sign a message with a private key. The recipient looks up the matching public key in DNS and checks whether the signed parts of the message survived transit.
You publish the public key. The private key stays with the sender and should never be pasted into DNS.
DKIM record anatomy
Suppose your provider gives you:
| Field | Example | Meaning |
|---|---|---|
| Selector | s1 | The label that chooses a key; providers may use google, k1, or another value |
| Sending domain | example.com | The domain the provider uses in the DKIM d= value |
| DNS name | s1._domainkey.example.com | The host where the public key is published |
| Record type | TXT | The DNS record type used for the public key |
| TXT value | v=DKIM1; k=rsa; p=... | The public key and optional key metadata |
In a DNS dashboard that automatically appends example.com, enter s1._domainkey as the host. In a dashboard that expects a fully qualified name, enter s1._domainkey.example.com. Adding the domain twice is a common cause of verification failure.
A realistic example
The exact public key must come from your email provider. The value below is intentionally shortened:
Type: TXT
Name: s1._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...
TTL: 3600Do not copy this shortened key into production. Copy the complete provider-generated value, preserve every character, and use the provider’s requested selector.
Google’s Gmail sender guidance recommends a 2,048-bit DKIM key when the provider supports it; it states that personal Gmail recipients require a key of at least 1,024 bits.
Publish and verify it
- Enable DKIM in the sending provider.
- Copy the selector, host, and complete public-key value.
- Add one TXT record at the DNS host.
- Wait for DNS visibility and provider verification.
- Send a real message from the configured From domain.
- Inspect the full headers for dkim=pass and the expected header.d or d= domain.
Use DNS tools to see what public resolvers return:
dig +short TXT s1._domainkey.example.comAn empty response can mean the record is not published, the host is wrong, or the record has not propagated. A response that contains a different key can mean an old selector is still active or another team manages the DNS zone.
DKIM and DMARC alignment
DKIM passing is not automatically the same as DMARC passing. For DMARC, the DKIM signing domain must align with the domain in the visible From header, or SPF must provide the aligned path.
| Header relationship | DKIM result | Possible DMARC result |
|---|---|---|
| d=example.com, From news@example.com | Pass and aligned | DMARC can pass |
| d=mail.example.com, From news@example.com | Pass; relaxed alignment may apply | DMARC can pass if policy and alignment mode allow it |
| d=provider.example, From news@example.com | Pass but not aligned | DKIM does not satisfy DMARC |
| DKIM signature missing | No DKIM path | DMARC can still pass through aligned SPF |
Inspect the actual headers after sending. DNS alone proves that a key exists, not that the provider used it.
Common failure modes
The host name is duplicated
Your DNS UI may append the zone name. Entering s1._domainkey.example.com into a relative-name field can create s1._domainkey.example.com.example.com.
The provider uses a different selector
A provider may rotate keys or offer separate selectors for different streams. The selector in the DNS record must match the selector in the message’s DKIM-Signature header.
The public key was wrapped or truncated
Some dashboards wrap long TXT values visually. Preserve the value as one logical record and use the provider’s exact instructions. A shortened example is not a valid key.
The old key was deleted too soon
Keep the old selector published while messages signed with it can still be in transit or in retries. Remove it only after the provider confirms rotation is complete.
DKIM passes but DMARC fails
Compare the DKIM d= domain with the visible From domain. If they do not align, either configure a custom DKIM domain or make sure aligned SPF is working.
Maintenance checklist
- Record which provider owns each selector.
- Keep private keys out of tickets, docs, and DNS.
- Rotate keys according to the provider’s policy.
- Remove obsolete selectors after the transition window.
- Monitor authentication reports for unexpected senders.
- Re-test after moving ESPs, changing From domains, or introducing a new subdomain.
FAQ
Is a DKIM record an MX record?
No. DKIM uses a TXT record at a selector-specific _domainkey host.
Can two DKIM records exist?
Yes, if they use different selectors. You should not publish two competing TXT values for the same selector.
Does DKIM encrypt email?
No. It signs selected message content so receivers can verify origin and integrity. It does not make the message confidential.
Do I need SPF if DKIM passes?
DMARC can pass through aligned DKIM, but Gmail recommends setting up SPF, DKIM, and DMARC together. SPF also covers a separate authorization path and can help with forwarding scenarios.
For the selector-specific version of this problem, see the DKIM selector example.