What is DKIM?
DKIM signs each outgoing message with a private key; receivers check the signature with the public key the domain publishes in DNS at selector._domainkey.domain. A valid signature proves the message came from someone holding the key and was not changed on the way. For DMARC, the signing domain must match the From domain.
How to find your DKIM selector
Open a message you sent and show its original source (Gmail: "Show original"; Outlook: "View message source"). Find the DKIM-Signature header: s= is the selector and d= the signing domain. There can be several, one per service that signs for you.
| Microsoft 365 | selector1, selector2 (CNAMEs to the tenant's onmicrosoft.com domain) |
|---|---|
| Google Workspace | |
| Mailchimp | k1, k2, k3 |
| SendGrid | s1, s2 |
| Zoho Mail | zoho, or one you named |
| Amazon SES, Postmark | Long random selectors only their dashboards show |
DKIM in Microsoft 365 and Google Workspace
Microsoft 365 signs with the tenant's onmicrosoft.com domain until you switch DKIM on for your own domain, and that signature does not align with DMARC. In the Defender portal (Email authentication settings, DKIM), create the keys, publish the two CNAME records, then switch signing on. The checker tells apart "CNAMEs missing" and "CNAMEs there but signing off".
Google Workspace: in the Admin console (Apps, Google Workspace, Gmail, Authenticate email) generate a 2048-bit key, publish it as a TXT record at google._domainkey, then press Start authentication.
Questions
It works everywhere, but 2048 bits is the recommendation and keys under 1024 are rejected. Rotate when your service allows it.
It is made by your browser's own cryptography (WebCrypto) in this page and never sent anywhere. Close the page and it is gone, so save it to your mail server straight away.
A TXT string may hold 255 characters, and a 2048-bit key is longer. Most DNS hosts split it for you; for those that do not, copy the split version, which is several quoted strings in one record.