Using a DKIM DNS entry
A DKIM DNS entry helps prove that an email really came from an authorised sender and that its contents haven't been tampered with in transit.
How it works
- Your email server creates a DKIM signature using a private cryptographic key and adds it to outgoing emails.
- You publish the corresponding public key in your domain's DNS as a DKIM record, usually a TXT record.
- When the recipient's mail server receives your email, it:
- Reads the DKIM signature from the email.
- Looks up your public key in your DNS.
- Uses that key to verify the signature.
- If verification succeeds, the recipient knows the message was signed by an authorised system and hasn't been altered.
A typical DNS entry looks something like:
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE"
The selector (selector1 in this example) tells the receiving server which public key to look up.
What DKIM does not do
DKIM doesn't encrypt the email. It also doesn't, by itself, prevent someone from spoofing your domain. That's where DMARC comes in: DMARC can tell receiving servers what to do when an email claiming to be from your domain fails authentication.
In simple terms:
SPF → "Was this server allowed to send?"
DKIM → "Was this email cryptographically signed by an authorised sender, and unchanged?"
DMARC → "What should you do if these checks fail?"
What is the DKIM entry I need?
Please open a ticket and we will provide you with the DNS entry and key for your service.
