Configure DKIM
Enable DKIM signing and publish selectors.
Objective
Authenticate a sending domain
Establish SPF, DKIM, and DMARC for a sending domain.
Starting state
ESP or MTA can sign; DKIM DNS not yet published or selectors need rotation
Prerequisites
- DNS edit rights
- Ability to enable DKIM signing in the sending platform
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- ESP or MTA admin
Inputs
- Domain
- DKIM selector(s)
- Public key TXT from the ESP/MTA
Step-by-step instructions
- Generate or retrieve keysIn the ESP/MTA, create or open the DKIM key for the sending domain and copy the public DNS record.
- Publish selector TXTAdd the selector DNS name the provider gives you (example): selector._domainkey.example.com as TXT or CNAME at authoritative DNS.
- Enable signingTurn on DKIM signing for the stream only after the public key is visible at the authority. Related Learn: DKIM; related Solve: DKIM selector not found.
- Confirm signaturesSend a test message and verify DKIM=pass in headers for the intended signing domain (d=). Rollback: disable signing or revert to the prior selector and remove bad DNS.
Verification
- Selector resolves authoritatively
- Production-like test shows DKIM pass
Common mistakes
- Signing enabled before DNS is live
- Wrong selector or truncated public key
- One selector per stream or shared?
- CNAME delegation to ESP vs hosting the public key yourself?
Rollback / recovery
- Disable signing or revert to the prior selector; remove bad DNS
Expected outcome
Outbound mail is DKIM-signed with a published, verifiable public key.
When to escalate
- Production mail impacted unexpectedly