Email & AuthenticationRFC 6376
DKIM Record — DKIM Record (DomainKeys Identified Mail TXT)
Publishes a cryptographic public key in DNS used to verify that an email message was signed by the domain and not tampered with in transit.
RECORD TYPE
DKIM
STANDARD RFC
RFC 6376
DEFAULT TTL
3600 seconds (1 hour)
CATEGORY
Email & Authentication
BIND Zone File Syntax Example
google._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."How to Query & Check DKIM Records
Linux / Mac (dig)
dig +short TXT google._domainkey.example.comWindows / Generic (nslookup)
nslookup -type=TXT google._domainkey.example.comPowerShell (Resolve-DnsName)
Resolve-DnsName -Name google._domainkey.example.com -Type TXTRecommended Best Practices
Use 2048-bit RSA keys for DKIM (1024-bit is considered cryptographically weak by modern security audits).
Primary Use Cases:
- •Authenticating emails sent from Google Workspace, SendGrid, Amazon SES, or Mailchimp
- •Eliminating "via sendgrid.info" warnings in email clients
- •Meeting mandatory Gmail & Yahoo deliverability standards
Common Configuration Mistake
Accidentally copying whitespace or truncating long 2048-bit keys when pasting into domain registrars.
Always verify records using authoritative queries (`dig @1.1.1.1 $DKIM example.com`) to bypass local ISP caching when debugging propagation delays.
Frequently Asked Questions
DNS DKIM Record Questions & Answers
Common questions regarding DNS propagation, TTL settings, and zone file syntax.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to the header of outgoing emails. Receiving servers fetch the public key published at `selector._domainkey.example.com` to cryptographically verify signature integrity.