Setting up DKIM: your domain's digital signature
DKIM signs every outgoing email cryptographically. How to set it up at Microsoft 365, Google Workspace and newsletter services — and check that it works.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing email. The receiver fetches the matching public key from your domain's DNS and uses it to verify two things: the email really comes from an authorised system, and it was not altered in transit. Unlike SPF, DKIM also survives forwarding — which is why it is the more robust of the two pillars.
How the setup works
You do not generate the key yourself — your sending service does. The setup therefore always follows the same pattern: enable DKIM in the service's admin portal, copy the DNS records shown into your domain's zone, then go back to the portal and click "verify" or "enable". The record lives under a so-called selector — a freely chosen name that allows several keys per domain:
selector1._domainkey.beispiel.atselector1-beispiel-at._domainkey.beispielfirma.onmicrosoft.comThe usual providers
- Microsoft 365: two CNAMEs (selector1/selector2), enable in the Defender portal under Email authentication.
- Google Workspace: one TXT record (default selector google), generate in the Admin console under Gmail → Authenticate email.
- Newsletter and sending services (Mailchimp, Brevo, Resend …): their own selectors, usually as CNAME — every service signs for itself, and every one needs its own records.
Checking that it works
Send yourself an email to a Gmail mailbox and open "Show original" there: dkim=pass with your domain means everything is right. Or check the domain with a tool that probes the common selectors in DNS — then you also see straight away whether key length and records are clean. 2048-bit keys are recommended today; what your provider generates is usually fine.
Frequently asked questions
Does every sending service need its own DKIM?
Yes. Every service signs with its own key under its own selector. A newsletter service cannot sign with your mail provider's key — both need their own DNS records.
What is a selector?
A freely chosen name in front of _domainkey under which the public key is stored in DNS (e.g. selector1._domainkey.your-domain.at). It allows any number of keys side by side — one per service, and a new one during key rotation without interruption.
Does missing DKIM hurt if SPF is correct?
Increasingly, yes. Google and Yahoo require SPF AND DKIM for bulk senders, and DMARC needs at least one of the two in aligned form. On forwarding, SPF breaks — then DKIM is the only thing that still identifies your email.