HTTPfy

DKIM record

A DKIM record publishes the public key that receivers use to verify the DKIM-Signature header on a message. It lives at <selector>._domainkey.<domain>.

stored as TXT RFC 6376RFC 8301RFC 8463

Live DKIM records from real domains

Checked at via public DNS
google._domainkey.github.comTXT
google._domainkey.github.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGf ... lKED659eiJcLnWcKDSiQlhwIDAQAB"
  ; DKIM public key: RSA, 2048-bit
s1._domainkey.paypal.comTXT
s1._domainkey.paypal.com. 300 IN CNAME s1.domainkey.u2325424.wl175.sendgrid.net.
  ; points to s1.domainkey.u2325424.wl175.sendgrid.net
s1.domainkey.u2325424.wl175.sendgrid.net. 1800 IN TXT "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxbgrZ8NI+r1z/S4RHUWdMmwmN+JGEY9Blcd1cqhocyKq+4qzU5TDXX4gKIZ2Apq3tTdA/a5hNEE4bPyhJ ... LR6FA1SUmB1375JL4pTXS6QIDAQAB"
  ; DKIM public key: RSA, 2048-bit
k2._domainkey.github.comTXT
k2._domainkey.github.com. 3600 IN CNAME dkim2.mcsv.net.
  ; points to dkim2.mcsv.net
dkim2.mcsv.net. 14400 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoU ... cCDun9DAI4Q/3z+Q0o9QuQIDAQAB;"
  ; DKIM public key: RSA, 2048-bit
s2._domainkey.github.comTXT
s2._domainkey.github.com. 3600 IN CNAME s2.domainkey.u51742174.wl175.sendgrid.net.
  ; points to s2.domainkey.u51742174.wl175.sendgrid.net
s2.domainkey.u51742174.wl175.sendgrid.net. 1800 IN TXT "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwB ... bSqdfGS+ixdSmJ69NwmYSHwIDAQAB"
  ; DKIM public key: RSA, 2048-bit
DKIM Record Checker for github.com (selector google) →

What the DKIM record does

The sending server signs selected headers and the body with a private key and adds a DKIM-Signature header whose d= tag names the signing domain and s= the selector. The receiver fetches the TXT record at s._domainkey.d and verifies the signature with the key in p=. Selectors let a domain run several keys at once, one per provider and one per rotation period.

RFC 8301 made RSA keys of at least 1024 bits mandatory, recommends 2048, and removed SHA-1. A 2048-bit key is about 400 base64 characters, so it must be split into several strings within one TXT record. Ed25519 keys (RFC 8463) are short, but not every receiver verifies them yet, so they are usually published next to an RSA key.

Zone-file syntax

google._domainkey.example.com.  3600  IN  TXT  ( "v=DKIM1; k=rsa; "
    "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..." "...IDAQAB" )

Wire format: A TXT record. Tags are semicolon separated; whitespace inside p= is ignored.

Fields

FieldMeaning
vDKIM1. Optional, but if present it must be first.
kKey type: rsa (default) or ed25519.
pBase64 public key (SubjectPublicKeyInfo for RSA). Empty means revoked.
hAllowed hash algorithms, e.g. sha256. Absent means all.
sService type: * (default) or email.
tFlags: y testing, s the i= domain must equal d= exactly (no subdomains).

Common mistakes

  • The DNS panel breaks the key by inserting spaces, quotes or a line break into the base64.
  • Publishing the key under the wrong name, for example google._domainkey.example.com.example.com because the panel appended the domain again.
  • Deleting the old selector the moment a new key goes live. Mail still in queues was signed with the old key; leave it for a few days, then publish an empty p=.
  • Still using a 1024-bit key years after the provider started supporting 2048.

Specification

  • RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
  • RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM
  • RFC 8463: A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM)

Related record types

  • DMARC: policy and reporting for the From domain
  • SPF: which servers may send mail for a domain
  • TXT: free-form text for verification and policy

All DNS record types