DNS Record Explainer

v=DKIM1
Version tag. Always "DKIM1" for current DKIM records. Identifies the record format to resolvers.

k=rsa
Key type. RSA is the standard. (ed25519 exists in specs but rarely deployed; most mail systems expect RSA.)

p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...
Public key material. This is the base64-encoded RSA public key that mail receivers use to verify signatures on outbound mail from your domain. The key shown is truncated; a full RSA-2048 key is ~390 characters, RSA-4096 around 680.

Key truncated in input — can't validate length. Ensure your actual key is:
• RSA-2048 minimum (2048 bits standard)
• RSA-4096 preferred (better security, still widely supported)
• Full base64 string without line breaks in the DNS TXT record

Missing optional tags:
• t= (flags field) — absent here. Common values: t=y (testing mode, don't enforce), t=s (sign subdomains only). Most records omit this; mail is enforced by default.
• h= (hash algorithms) — not shown. Defaults to sha256, which is correct. Only set explicitly if you need sha1 for legacy systems (not recommended).

No issues detected with the tags present, but verify:
• The full p= value is correctly placed in DNS as a single TXT record (may need quotes if split across lines)
• Selector (the subdomain prefix, e.g., "default._domainkey.yourdomain.com") exists and matches your mail server config

This record lives at `._domainkey.` and authenticates email you send. Mail receivers query it after receiving a signed message; they extract the selector from the DKIM-Signature header, fetch this public key, and verify the signature. Without it, your DKIM signatures fail verification and mail lands in spam or gets rejected outright. Multi-selector setups (rotating keys) require separate records for each selector.

→ /tools/dkim-checker run the live checker on a real domain → /blog/dkim-key-not-found