DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email-authentication method that attaches a cryptographic signature to each message. The receiving server verifies the signature against a public key in the sender's DNS, proving the message wasn't altered in transit and genuinely came from the signing domain.
How it works
Your mail server signs outgoing messages with a private key; you publish the matching public key as a DNS TXT record at a named selector. Receivers fetch the key and validate the signature.
Why it matters
DKIM survives forwarding better than SPF and is required (with SPF and DMARC) by Gmail and Yahoo for bulk senders. Valid DKIM alignment is a core trust signal for inbox placement.
What is a DKIM selector, and how do you find yours?
Open the headers of a message you sent and find the DKIM-Signature line. Two tags matter. d= names the signing domain and s= names the selector. The public key then lives at selector._domainkey.domain, so a signature carrying d=yourdomain.com and s=mail2024 is verified against the TXT record at mail2024._domainkey.yourdomain.com.
Selectors let several services sign for the same domain without sharing a key. Your mailbox provider, your helpdesk and your billing tool can each publish their own selector. If a lookup of the selector returns nothing, the signature fails even though the service is signing correctly, which is the most common reason a new tool shows dkim=fail on day one.
How long should a DKIM key be, and how do you rotate it?
Google recommends 2048-bit keys. Some DNS hosts limit a single TXT string to 255 characters, so a 2048-bit public key has to be split into several quoted strings inside one record. If the panel silently truncates the value instead, receivers cannot parse the key and every message fails.
Rotation works by overlap. Publish a new selector with a new key, switch the signing service to it, and leave the old selector published for a while so messages already in transit or queued for retry still verify. Only then delete the old record. How often to rotate is a call for your security team; the overlap is what prevents an outage.
Why does DKIM fail when the record looks correct?
Three causes cover most cases. A gateway or security appliance changed the body after signing, for example by appending a legal footer, and the body hash no longer matches. The key was pasted with a stray space or line break. Or the service signs with its own domain, so d= points at the vendor: the signature passes, but it is unaligned and gives no credit toward DMARC.
The c= tag in the signature shows the canonicalization mode. relaxed/relaxed tolerates whitespace and header-case changes that simple rejects, so it survives more relays. When you check a live message with the SPF, DKIM and DMARC checker, compare d= with your From domain first; that single comparison explains most alignment failures. Autocloz surfaces unaligned or broken selectors per sending domain, next to the SPF status.
Can one message carry more than one DKIM signature?
Yes, and it is common. A sending platform may sign once with its own domain for its internal reputation tracking and once with yours. Receivers verify each signature separately, and DMARC passes on the DKIM side if at least one signature both verifies and aligns with the From domain. That is why seeing a failed signature in the headers is not always a problem: read every DKIM-Signature line, note which d= values passed, and check whether any passing one matches your domain. If only the vendor's signature passes, ask the vendor for custom-domain signing, usually a CNAME or TXT record they give you to publish. Our walkthrough on checking SPF, DKIM and DMARC records shows where each value appears.
How Autocloz handles it
Autocloz monitors DKIM signing and alignment for every sending domain and surfaces broken or unaligned selectors in the deliverability view so you fix them before sending volume.
Free tools for this
No signup required — they run in your browser.
FAQ
What is DKIM alignment?
Alignment means the domain in the DKIM signature matches the visible From domain. DMARC passes when SPF or DKIM is aligned; unaligned signatures still fail DMARC.
Related terms
Cold email deliverability is the share of your outbound cold emails that actually reach the recipient's inbox (not spam, not blocked). It depends on domain authentication (SPF, DKIM, DMARC), sender reputation, mailbox warmup, list hygiene and content — not just whether the email was 'sent'.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email standard that tells receiving mail servers what to do with messages that fail SPF or DKIM checks — and sends you reports. It prevents spoofing of your domain and is now effectively required by Gmail and Yahoo for bulk senders.
SPF (Sender Policy Framework) is an email-authentication standard that lets a domain owner publish, in DNS, the list of mail servers allowed to send email on the domain's behalf. Receiving servers check the sending IP against that list to help detect spoofing and decide whether to trust the message.
Mailbox warmup is the practice of gradually increasing a new email account's sending volume while generating positive engagement (opens, replies, moving mail out of spam) so mailbox providers build trust in the sender before real campaigns ramp up.
Sources
Want this applied to your setup?
This is a reference page. If you have a specific question about your own outreach, leave your email and a human on our team will reply.