What is DKIM, and how does signing your email build trust?

What does DKIM do?

DKIM stands for DomainKeys Identified Mail. When you send a message, your mail server creates a signature from the content and headers using a private key that only you hold. The matching public key lives in your DNS. The receiving server fetches that public key, checks the signature, and confirms two things: the mail genuinely came from your domain, and nobody changed it along the way.

What is a DKIM selector?

A selector is a label that tells receivers which DKIM key to use, since a domain can publish several. The public key lives at selector._domainkey.yourdomain.com. For example, Google Workspace often uses the selector google, and Microsoft 365 uses selector1 and selector2. To check DKIM, you need to know your selector, which you can find in your sending tool's settings or in the DKIM-Signature header of a sent message.

Why 2048-bit keys matter

DKIM keys come in different sizes. Older setups used 1024-bit keys, but 2048-bit keys are now the recommended standard because they are far harder to crack. If your provider still uses a 1024-bit key, it is worth rotating to 2048-bit where supported. When you generate a new key with a DKIM Generator, choose 2048-bit.

Why DKIM matters for cold email

DKIM is the signature that survives forwarding. Unlike SPF, which can break when mail is forwarded, a DKIM signature travels with the message. That makes it the more durable half of DMARC alignment. For cold email, a valid DKIM signature tells mailbox providers your mail is genuine and untampered, which directly supports inbox placement. Check your key is published and valid with a DKIM Checker.

Frequently asked questions