A DKIM (DomainKeys Identified Mail) record is a DNS record that allows receiving mail servers to verify that an email was genuinely sent by an authorised server for your domain and that it hasn't been altered in transit.

DKIM is one of the three core email authentication technologies, alongside:

• SPF – specifies which mail or hosting servers are authorised to send email for your domain.
• DKIM – digitally signs outgoing emails from the mail server.
• DMARC – tells receiving mail servers what to do if SPF and/or DKIM fail.

How DKIM works

1. Your email server sends an email.
2. Before sending, it creates a digital signature using a private key.
3. The digital signature is added to the email header.
4. The receiving mail server looks up the corresponding public key stored in your domain's DNS.
5. It uses the public key to verify the digital signature.
6. If the digital signature is valid, the recipient knows:
   • The email really came from an authorised sender.
   • The email content has not been modified after it was sent.

What does a DKIM DNS record look like?

A DKIM record is usually published as a TXT record. However some mail platforms such as MailGun, MailChimp and SendGrid provide a record that needs to be added in as a CNAME. Example shown below. (This is only an example. Do not use)

Host name: selector._domainkey.domainname.co.nz

Type: TXT or CNAME

Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQE.....

Where:

• v=DKIM1 = DKIM version.
• k=rsa = Encryption algorithm.
• p= = The public key used to verify the signature. 

What is a selector?

The selector identifies which DKIM key should be used. Generally this would be something like base, sl1, kl1 or default. In this example, base._domainkey.domain.co.nz, base is the selector.

_domainkey indicates that the record is a DKIM record. For the same example, base._domainkey.domain.co.nz would indicate that it is a DKIM record.

domain.co.nz is the domain the DKIM is connected to. You would replace that with your domain name. E.g. base._domainkey.1stdomains.nz

Why is DKIM important?

Without DKIM:

• Attackers can more easily spoof your domain.
• Your emails are more likely to be marked as spam.
• DMARC cannot fully authenticate your messages.

With DKIM:

• Your domain is better protected against spoofing.
• Email providers are more likely to trust your messages.
• Email deliverability improves.
• DMARC authentication is strengthened.

In summary, a DKIM record is a public encryption key stored in DNS that allows receiving mail servers to verify the digital signature on your outgoing emails, helping ensure they are authentic and have not been tampered with.

DKIM records are not automatically assigned to your domain. If you would like a DKIM assigned, please contact our support team and we will add it to your domain. If you are using a third party email host, you would need to contact them for the record details.