Setup guide

How to Set Up DKIM — Configuration and DNS Selectors

How to set up DKIM and complete DKIM configuration: enable signing, publish selector records in DNS, verify signatures, and align with DMARC for Workspace, Microsoft 365, and SaaS.

This guide shows how to set up DKIM and configure DKIM for domains you control. You will enable signing on each platform that sends as your brand, publish the public key (or CNAME) in DNS, prove signatures on real messages, and make sure the signature domain aligns for DMARC.

DKIM is the check that most often still works after mailing-list and forward paths break SPF. Without it, DMARC enforcement is fragile. Complete SPF setup in parallel so both authentication paths exist.

What DKIM does

DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to outbound messages. Receivers fetch the public key from DNS at selector._domainkey.yourdomain and verify that signed headers and body parts were not altered in transit. A passing signature proves the signing domain authorised the message; for DMARC you also need that domain to align with the visible From domain.

1. Enable DKIM signing on every sending platform

Each mail system that sends as your domain needs its own DKIM setup. In admin consoles this is often labelled “Authenticate domain”, “DKIM”, “DomainKeys”, or “DNS records for email.”

Google Workspace — Admin console → Gmail → Authenticate email. Generate records for the domain; Google typically provides CNAMEs such as google._domainkey (names vary by generation flow). Enable signing after DNS verifies.
Microsoft 365 — Defender / Exchange admin → DKIM. Publish the two CNAME records Microsoft shows (often selector1 and selector2 under _domainkey), then enable DKIM for the domain.
Marketing and transactional SaaS — complete their domain authentication wizard; many ask for one or more CNAMEs pointing at their key hosts, or a TXT with v=DKIM1; k=rsa; p=….
Self-hosted MTAs — generate a key pair, configure the signing service (OpenDKIM or equivalent), and publish the public key as TXT under your chosen selector.

Do not skip a low-volume tool. It will fail DMARC later when its volume appears in aggregate reports. Keep a short inventory of platforms and selectors next to your SPF list.

2. Publish selector DNS records

Vendors ask for one or more records under a selector name. The left-hand side is always of the form <selector>._domainkey.<domain>.

Host: selector1._domainkey.yourdomain.co.za
Type: CNAME
Value: selector1-yourdomain-co-za._domainkey.<vendor-host>   (example shape — use the exact target your vendor shows)

Self-hosted or TXT-style public keys look more like:

Host: mail._domainkey.yourdomain.co.za
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh…(your public key)…

Copy hostnames and values exactly — a missing _domainkey label or truncated p= key fails verification
Wait for DNS TTL to expire (or use a low TTL during rollout) before testing
Keep old selectors published during rotation until the new key is signing all traffic
Some DNS hosts split long TXT strings; follow their multi-string rules so the concatenated key remains valid

3. Confirm signatures on real messages

Send a message from each platform to an external mailbox you control (e.g. a free consumer account)
Inspect DKIM-Signature (note s= selector and d= domain) and Authentication-Results
Use the DKIM check when you know the selector name to confirm the public key is published
Once DMARC reporting is on, look for DKIM pass with alignment to your organisational domain — not only “signed by a vendor domain”

If the signature is missing, the platform is not signing yet (or is signing a different From domain). If the signature is present but fails, the public key in DNS usually does not match the private key in use, or the message was modified after signing.

4. Align DKIM with DMARC for your From domain

For DMARC, the DKIM d= domain must align with the visible From domain (same organisational domain under relaxed alignment, or exact match under strict). Signing with only an unrelated vendor domain (e.g. d=vendor-app.com while From is you@yourdomain.co.za) does not help DMARC for your brand.

Complete each vendor’s “custom domain” / “authenticate your domain” path so signatures use your domain (or a subdomain you control that aligns under your DMARC policy). Then proceed with DMARC setup at p=none and watch reports.

Common mistakes and troubleshooting

DNS published but signing never enabled — Microsoft 365 and others require an explicit “enable DKIM” after CNAMEs validate.
Wrong or truncated public key — TXT cut off by DNS UI length limits; re-check with a DKIM lookup tool.
Testing before TTL expires — old NXDOMAIN or stale key still cached at the receiver.
Only one of two required selectors — some vendors publish dual selectors for rotation; both CNAMEs must exist.
Selector works in free-tools but production From is a different domain — marketing tools often sign a subdomain; confirm alignment with the From users see.
Rotating keys and deleting the old selector too early — in-flight or delayed mail may still use the previous key.
Assuming SPF is enough — forwards and some relays break SPF; DKIM is the second path DMARC needs.

FAQ

What is a DKIM selector?

A short label that points to one public key in DNS (the s= tag in the signature). Multiple selectors let you rotate keys or run several signing systems on the same domain without overwriting each other.

CNAME or TXT — which is correct?

Both are valid. Large SaaS platforms often use CNAME so they host and rotate the key for you. Self-hosted and some tools use a TXT record with v=DKIM1 and a p= public key. Always follow the vendor’s exact instructions.

How do I find the selector for a live message?

Open the raw message source and find DKIM-Signature:. The s= parameter is the selector; d= is the signing domain. Query DNS at s=._domainkey.d=.

Do I need DKIM on every subdomain?

You need signing (and DNS keys) for every identity that appears in From / signing configuration. If marketing sends as news.yourdomain.co.za, that domain (or the organisational domain strategy you chose) needs authentication — not only the apex used for staff mail.

Will DKIM stop phishing that uses lookalike domains?

No. DKIM authenticates mail that claims your domain in the signature path. Lookalike domains need separate detection and process — see lookalike domains vs spoofing.