DNS Record Explainer

v=DKIM1
Version tag. Always "DKIM1" for current spec. Tells receivers this is a DKIM public key record.

k=rsa
Key type. RSA is the standard. (ed25519 exists in newer specs but isn't widely deployed yet.) Tells the receiver which algorithm was used to sign the mail.

p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...
Public key payload (base64-encoded). This is the actual RSA public key. Receiver uses this to verify DKIM signatures on inbound mail from your domain. The value shown is truncated—full keys are typically 1024–2048 bits. This is where the signature verification happens.

• Record is truncated in your input. Full RSA public keys are 340–400+ characters base64. If you're testing, paste the complete value or this won't verify.
• No optional tags present (h=, c=, t=, s=). Usually fine—they set hash algorithm (defaults to sha256), canonicalization (defaults to simple/simple), test mode, and service type. Add only if non-default behavior is needed.
• Ensure this record is published at the correct selector. DKIM lookup is `selector._domainkey.yourdomain.com`. If your selector is "default" and domain is "example.com", the full DNS name must be `default._domainkey.example.com`. Mismatched selector = signatures won't verify.
• RSA-2048 is now best practice; RSA-1024 still works but weaker. Verify your key length isn't 512 or 1024 bits if you control key generation.

DKIM signs outbound mail so receivers can cryptographically verify you sent it. Without this record published correctly, your DKIM signature validation will fail at recipient servers. This breaks SPF/DMARC alignment, tanks deliverability, and increases spam/phishing risk. Gmail, Microsoft, and others require DKIM + SPF + DMARC for bulk senders. If mail isn't authenticating, first check: record is published at the right selector, p= value is complete and correct, and no trailing spaces or newlines.

→ /tools/dkim-checker run the live checker on a real domain → /blog/dkim-key-not-found