What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to email. The public key is published in DNS at a name like selector._domainkey.yourdomain so receivers can verify the email came from you and was not changed on the way.
How DKIM works
Your email provider signs each message with a private key. The receiver fetches the public key from DNS and checks the signature. If the message was changed or came from somewhere else, it fails.
Selectors and where to get the key
The selector is the name of the key, for example google for Google Workspace, or selector1 and selector2 for Microsoft 365. Your email provider generates the key; you only publish the record it gives you.
google._domainkeyValue(the key from your provider, starting with v=DKIM1)Common questions
What is a DKIM selector?
A name that says where the key is in DNS. You can see it in the s= value of the DKIM-Signature header on your email.
Do I need DKIM if I have SPF?
Yes. SPF often fails when email is forwarded, but the DKIM signature travels with the message. DMARC passes if either one passes, so both together are safest.