What Is DKIM? How Email Signing Works and How to Set It Up

If SPF is the guest list that says which servers may send for you, DKIM is the wax seal on the envelope. It's one of the records Gmail expects from every sender now, and it's the one most small businesses never knowingly set up, because their email provider did half the job for them.

How DKIM works, in five steps

Google's admin help describes the process like this:

1. Your domain has a pair of DKIM keys: a private key on your email server and a public key in your domain's DNS.
2. When you send an email, your server uses the private key to add a DKIM signature to the message header.
3. The email travels to the recipient's domain.
4. The receiving server looks up your public key from the DKIM TXT record on your domain.
5. It uses that key to read the signature and authenticate the email.

The two keys, side by side

	Private key	Public key
Where it lives	On your email server	In a TXT record on your domain
What it does	Adds the signature to each outgoing message	Lets receivers read and check that signature
Who can see it	Only your mail system	Anyone who looks up your DNS

What a selector is and why it matters

DKIM records sit under a name made of a selector followed by ._domainkey on your domain. The selector lets one domain have several DKIM keys, which is handy because your newsletter platform, CRM and main mailbox may each sign mail separately. In Google Workspace, Google says the default selector is google. If you're not on Google Workspace, Google suggests sending yourself a test email, viewing the message source and finding the s value in the DKIM-Signature header to see which selector your provider uses.

Which key length to choose

Google gives two options when you generate a key in the Admin console:

• 2048-bit. Choose this if your domain provider supports 2048-bit keys.
• 1024-bit. Use this only if your domain host doesn't support 2048-bit keys.

Google's sender guidelines say sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, so either passes, but 2048 is the stronger choice where your host allows it.

How to set up DKIM in Google Workspace

1. Sign in to the Google Admin console as a super administrator.
2. Generate a DKIM key for your domain, choosing the key length and keeping the default selector unless you need another.
3. Copy the DNS host name and the TXT record value Google shows you.
4. At your domain host, add a TXT record using that host name and value.
5. Go back to the Admin console and turn on authentication for the domain.

Two timing notes from Google save a lot of worry. After you turn on Gmail for your organisation, you must wait 24 to 72 hours before you can get your DKIM key. And after you add the record, the Admin console might keep showing a message saying you must update your DNS records for up to 48 hours while it catches up.

When you might not need to do anything

Google says you might not need to set up DKIM if your domain already has it by default, or if you bought your domain from a Google partner when you signed up for Google Workspace. If your domain is with Squarespace, Google says the DKIM key is created and added for you automatically, so you skip straight to turning it on. You can check what's already in place with one of the free DNS lookup tools online.

How to check DKIM is working

The quickest test needs nothing more than your own inbox. Send an email from your domain to a personal address, open it and view the message source or original message. Look for a DKIM-Signature header: the d value shows the domain that signed it and the s value shows the selector. If the header is missing, or it shows your email provider's domain instead of yours, your messages aren't being signed as your domain yet. Repeat the test for each tool that sends email for you, because each one signs separately. If messages are signed and still land in spam, my guide on why emails get marked as spam covers the other causes.

Don't forget the tools that send email for you

Your main mailbox is only part of the picture. Newsletter platforms, CRMs, booking systems and online shops often send email using your domain, and each needs its own DKIM setup, usually by adding a record they give you. Google also warns that outbound gateways that change messages, such as adding a footer, can break DKIM signatures. If you use one, check its settings.

My verdict

Set up DKIM for your main mailbox and for every tool that sends as your domain, pick a 2048-bit key where you can, and then add a DMARC record so inboxes know what to do with mail that fails. If you're choosing an email platform at the same time, my email marketing guide for small businesses covers what to look for.

Frequently asked questions

What does DKIM do?

It adds a digital signature to each email you send. Receiving servers use the public key on your domain to check the message came from your domain and wasn't changed.

Where is the DKIM public key stored?

In a DNS TXT record on your domain. Its name is your DKIM selector followed by ._domainkey.

Should I use a 1024-bit or 2048-bit DKIM key?

Google says choose 2048-bit if your domain provider supports it, and 1024-bit only if it doesn't. Gmail requires 1024 bits or longer.

How long does DKIM take to start working in Google Workspace?

After turning on Gmail you wait 24 to 72 hours to get your key, and the Admin console can show an update message for up to 48 hours after you add the record.

Is DKIM required to send to Gmail?

Google says all senders to personal Gmail accounts must set up SPF or DKIM, and bulk senders must set up SPF, DKIM and DMARC.