Domain security

What is DKIM and how does it work?

Reviewed 2 November 2026 by the SageRank team

Short answer

DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. Your mail system signs with a private key, and receivers verify the signature with a public key published in your DNS under a selector. A valid signature shows the message was not changed and that your domain approved it.

How it works

Your mail provider signs outgoing messages with a private key.
The signature names a selector and your domain.
The receiver looks up the public key in DNS and checks the signature.

The DNS record

The public key is a TXT record at selector._domainkey.yourdomain. Your provider gives you the exact name and value.

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Practical tips

Use 2048-bit keys where your provider allows it.
Enable DKIM for every service that sends as your domain, not only your main mailbox.
Rotate keys now and then, and remove selectors you no longer use.
Check an email’s headers for dkim=pass to confirm it works.

Why it matters for DMARC

DMARC passes when SPF or DKIM passes and aligns with the From domain. DKIM survives forwarding better than SPF, so it is usually the more reliable of the two.

How SageRank helps

The free report does not test domain security. SageRank’s Sentinel and Ultimate plans run ten levels of domain security checks through ShieldAI. See ShieldAI.