← All articles

The DKIM record (_domainkey) explained: structure, example and what each value means

The DKIM record is a TXT record under selector._domainkey.your-domain containing the public key. Example ready to copy, every parameter (v, k, p, t) explained, finding your selector, checking the record.

6 min read · Updated 7 September 2026

A DKIM record is a TXT record in your domain's DNS that publishes the public key for the DKIM signature. It always lives under a name following the pattern selector._domainkey.your-domain.com — "_domainkey" is the fixed part, the selector a freely chosen name set by your sending service. For every email, the recipient reads from the signature which selector is meant, fetches the key under exactly that name and uses it to verify that the message came unaltered from an authorised system.

What a DKIM record looks like

The name consists of three parts: the selector (here selector1), the fixed word _domainkey and your domain. In many DNS forms you only enter selector1._domainkey, because the form appends the domain automatically.

What the parameters mean

• v=DKIM1 — the version. Optional, but if present it must come first. DKIM1 is the only version.
• k=rsa — the key type. rsa is the default and may be omitted; ed25519 is the newer, shorter variant that not every recipient verifies yet.
• p=… — the public key, Base64-encoded. The only mandatory value. An empty p= means: this key has been revoked.
• t=s — "strict": the signing domain (d=) must exactly match the domain in the record, subdomains are not allowed. t=y marks test mode — recipients should not penalise failures then.
• h=sha256 — permitted hash algorithms. Rarely set; sha1 is considered obsolete.
• s=email — the service the key applies to. Default is * (all); practically always omitted.
• n=… — a free-text note for humans, not evaluated by any verifier.

TXT or CNAME?

Many providers do not have you create a TXT record with the key, but a CNAME pointing to a name at their side — the TXT record with the actual key then lives with the provider, and they can rotate the key without you changing anything. Microsoft 365 works this way:

For the recipient both are the same: it queries the TXT record and follows the CNAME automatically. What matters is that both do not exist under one name — a CNAME may not have any other records alongside it.

Finding your domain's selector

The selector is chosen by the sending service, not by you. You will find it in two places: in the service's portal (where the DNS records are displayed) or in a sent email. Open the headers of an email you sent to yourself and look for the DKIM-Signature line: the value after s= is the selector, the one after d= the signing domain. The mailampel header check reads both for you.

Checking the record

Fastest with the domain check: it probes the common selectors and rates key length and syntax. By hand, use nslookup -type=TXT selector1._domainkey.your-domain.com (Windows) or dig TXT selector1._domainkey.your-domain.com. The record must contain v=DKIM1 or at least p= and must not be empty. How to switch on DKIM at your provider is in Setting up DKIM; what the record achieves together with SPF and DMARC is in SPF, DKIM, DMARC: the difference.