DKIM explained: selectors, keys and rotation

What DKIM does

DKIM (DomainKeys Identified Mail) has the sending server sign each message with a private key. The matching public key is published in DNS, so any receiver can check the message really came from someone holding the key and wasn't changed on the way.

Selectors and where keys live

A domain can have many keys, one per service, each at its own name called a selector. The key sits at selector._domainkey.domain:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

v=DKIM1

Marks the record as a DKIM key.

k=

The key type: rsa, or ed25519 for newer keys.

p=

The public key itself. An empty p= means the key has been withdrawn.

Some providers publish a CNAME at the selector instead, pointing at a key they manage and rotate for you. Microsoft 365 works this way.

Key length

RSA keys shorter than 1024 bits are no longer accepted, and 2048 bits is the recommended length. Older set-ups often still use 1024-bit keys; they work today, but are worth replacing, and our checks flag them as something to improve.

Signing with the right domain

Many services sign with their own domain by default, such as a newsletter tool signing as itself. The signature passes, but it doesn't match the From domain, so it doesn't count for DMARC. Look for “custom domain” or “domain authentication” in each service's settings, and publish the records it gives you.

Changing keys without a gap

1. Create the new key in the provider's settings, under a new selector.
2. Publish it in DNS and wait for it to be visible everywhere, usually within an hour.
3. Switch signing to the new selector.
4. Leave the old key published for a week or so, since messages already sent may still be checked, then remove it.